CVE-2019-20032 MEDIUM

Published: 2020-07-29 | Last Modified: 2024-11-21 | Status: Modified

Description

An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices, may access the system's administration modem.

Additional Descriptions (1)

Un atacante con acceso a un buzón de correo de voz de InMail equipado con la funcionalidad find me/follow me en Aspire-derived NEC PBXes, incluyendo todas las versiones de los dispositivos SV8100, SV9100, SL1100 y SL2100, puede acceder al módem de administración del sistema

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	LOW
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	HIGH
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Base Score: 4.0 (MEDIUM)

AV:N/AC:L/Au:S/C:N/I:P/A:N

Access Vector	NETWORK
Access Complexity	LOW
Authentication	SINGLE
Confidentiality Impact	NONE
Integrity Impact	PARTIAL
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 8.0

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Primary	en NVD-CWE-noinfo

Affected Products

Vendor	Product	Version	Update	Type
nec	sv8100_firmware	*	<built-in method update of dict object at 0x7e60bbd630c0>	Operating System
nec	sv9100_firmware	*	<built-in method update of dict object at 0x7e6111c1fe00>	Operating System
nec	sl1100_firmware	*	<built-in method update of dict object at 0x7e61342e79c0>	Operating System
nec	sl2100_firmware	*	<built-in method update of dict object at 0x7e6112303140>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:nec:sv8100_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:nec:sv8100:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:nec:sv9100_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:nec:sv9100:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:nec:sl1100_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:nec:sl1100:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:nec:sl2100_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:nec:sl2100:-:::::::*`

References

https://shadytel.su/files/nec_cve.txt
Source: [email protected]

Third Party Advisory
https://shadytel.su/files/nec_cve.txt
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory