Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2019-14260

Description

On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.

POC

Reference

- https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Alcatel_8008CloudEditionDeskPhone.pdf?_=1559026340

Github

No PoCs found on GitHub currently.