CVE-2014-2650

Published: Jan 9, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface

Affected (15)

Products: Atos: Openstage 80 Firmware, Openstage 80 G Firmware, Openstage 60 G Firmware, Openstage 60 Firmware, Openstage 40 Firmware, Openstage 40 G Firmware, Openstage 20 E Firmware, Openstage 20 Firmware, Openstage 20 G Firmware, Openstage 15 Firmware, Openstage 15 G Firmware, Openstage 5 Firmware, Openscape Desk Phone Ip 35g Firmware, Openscape Desk Phone Ip 35g Eco Firmware, Openscape Desk Phone Ip 55g Firmware

Atos

15 products

Openstage 80 Firmware

Openstage 80 G Firmware

Openstage 60 G Firmware

Openstage 60 Firmware

Openstage 40 Firmware

Openstage 40 G Firmware

Openstage 20 E Firmware

Openstage 20 Firmware

Openstage 20 G Firmware

Openstage 15 Firmware

Openstage 15 G Firmware

Openstage 5 Firmware

Openscape Desk Phone Ip 35g Firmware

Openscape Desk Phone Ip 35g Eco Firmware

Openscape Desk Phone Ip 55g Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openstage 80 Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openstage 80	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openstage 80 G Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openstage 80 G	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openstage 60 G Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openstage 60 G	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openstage 60 Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openstage 60	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openstage 40 Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openstage 40	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openstage 40 G Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openstage 40 G	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openstage 20 E Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openstage 20 E	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openstage 20 Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openstage 20	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openstage 20 G Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openstage 20 G	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openstage 15 Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openstage 15	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openstage 15 G Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openstage 15 G	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openstage 5 Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openstage 5	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openscape Desk Phone Ip 35g Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openscape Desk Phone Ip 35g	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openscape Desk Phone Ip 35g Eco Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openscape Desk Phone Ip 35g Eco	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Atos Openscape Desk Phone Ip 55g Firmware	Version v3 r3.11.0

Running on/with	Platform Versions
Atos Openscape Desk Phone Ip 55g	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (4)

http://assets.yourcircuit.com/Internet/web/Container%20Site/Misc/Footer-content/privacy-policy/security-advisories.aspx

Source: cve@mitre.org

Third Party Advisory

https://networks.unify.com/security/advisories/OBSO-1403-01.pdf

Source: cve@mitre.org

Vendor Advisory

http://assets.yourcircuit.com/Internet/web/Container%20Site/Misc/Footer-content/privacy-policy/security-advisories.aspx

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://networks.unify.com/security/advisories/OBSO-1403-01.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.