polycom Archives - CVE Vulnerability

CVE-2007-3368

Sun, 26 Feb 2023 09:06:42 +0000

Buffer overflow in the HTTP server on the Polycom SoundPoint IP 601 SIP phone with BootROM 3.0.x+ allows remote attackers to cause a denial of service (device reboot) via a malformed CGI parameter.

The post CVE-2007-3368 appeared first on CVE Vulnerability.

CVE-2007-3369

Sun, 26 Feb 2023 09:06:42 +0000

Buffer overflow in the Polycom SoundPoint IP 601 SIP phone with BootROM 3.0.x+ and SIP version 1.6.3.0067 allows remote attackers to cause a denial of service (device hang or reboot) via an INVITE message with a long Via header.

The post CVE-2007-3369 appeared first on CVE Vulnerability.

CVE-2018-18566

Sun, 26 Feb 2023 06:47:50 +0000

The SIP service in Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allow remote attackers to obtain sensitive phone configuration information by leveraging use with an on-premise installation with Skype for Business.

The post CVE-2018-18566 appeared first on CVE Vulnerability.

CVE-2018-18568

Sun, 26 Feb 2023 06:47:50 +0000

Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.

The post CVE-2018-18568 appeared first on CVE Vulnerability.

CVE-2018-14934

Sun, 26 Feb 2023 06:46:31 +0000

The Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access Control. An attacker can connect without authentication and subsequently record audio from the device microphone.

The post CVE-2018-14934 appeared first on CVE Vulnerability.

CVE-2018-14935

Sun, 26 Feb 2023 06:46:31 +0000

The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS.

The post CVE-2018-14935 appeared first on CVE Vulnerability.

CVE-2019-14259

Sun, 26 Feb 2023 06:30:30 +0000

On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the “Time Service Settings web” interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.

The post CVE-2019-14259 appeared first on CVE Vulnerability.

CVE-2019-12948

Sun, 26 Feb 2023 06:30:04 +0000

A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.

The post CVE-2019-12948 appeared first on CVE Vulnerability.

CVE-2019-10688

Sun, 26 Feb 2023 06:29:17 +0000

VVX products with software versions including and prior to, UCS 5.9.2 with Better Together over Ethernet Connector (BToE) application 3.9.1, use hard-coded credentials to establish connections between the host application and the device.

The post CVE-2019-10688 appeared first on CVE Vulnerability.

CVE-2019-10689

Sun, 26 Feb 2023 06:29:17 +0000

VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides insufficient authentication between the BToE application and the BToE component, resulting in leakage of sensitive information.

The post CVE-2019-10689 appeared first on CVE Vulnerability.