CVE-2019-14259: OS Command Injection
On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the "Time Service Settings web" interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-14259?
CVE-2019-14259 is considered a medium severity vulnerability due to the potential for command injection by an authenticated attacker.
How do I fix CVE-2019-14259?
To mitigate CVE-2019-14259, upgrade the Polycom Obihai Obi1022 firmware to a version that addresses the command injection issue.
Who is affected by CVE-2019-14259?
CVE-2019-14259 affects users of the Polycom Obihai Obi1022 VoIP phone running firmware version 5.1.11.
What type of vulnerability is CVE-2019-14259?
CVE-2019-14259 is a command injection vulnerability caused by missing input validation in the NTP server IP address field.
Can CVE-2019-14259 be exploited remotely?
Yes, CVE-2019-14259 can be exploited by an authenticated remote attacker within the same network.