CVE-2014-2650

published 2020-01-09

CVE-2014-2650: Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface

Priority P2 61 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface

Affected

15 ranges

Vendor	Product	Version range	Fixed in
atos	openscape_desk_phone_ip_35g_eco_firmware	—	—
atos	openscape_desk_phone_ip_35g_firmware	—	—
atos	openscape_desk_phone_ip_55g_firmware	—	—
atos	openstage_15_firmware	—	—
atos	openstage_15_g_firmware	—	—
atos	openstage_20_e_firmware	—	—
atos	openstage_20_firmware	—	—
atos	openstage_20_g_firmware	—	—
atos	openstage_40_firmware	—	—
atos	openstage_40_g_firmware	—	—
atos	openstage_5_firmware	—	—
atos	openstage_60_firmware	—	—
atos	openstage_60_g_firmware	—	—
atos	openstage_80_firmware	—	—
atos	openstage_80_g_firmware	—	—

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78