NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts in the telephone user interface (TUI), effectively allowing brute force attacks.
NEC UM8000, UM4730 y anteriores a sistemas de correo de voz que no son InMail con todas las versiones de software conocidas pueden permitir un número infinito de intentos de inicio de sesión en la interfaz de usuario del teléfono (TUI), permitiendo efectivamente ataques de fuerza bruta
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | NONE |
AV:N/AC:L/Au:N/C:P/I:P/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-307
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| nec | um8000_firmware | * | <built-in method update of dict object at 0x7e611239d040> | Operating System |
| nec | um4730_firmware | * | <built-in method update of dict object at 0x7e60baa354c0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:nec:um8000_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:nec:um8000:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:nec:um4730_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:nec:um4730:-:*:*:*:*:*:*:* |