CVE-2019-12324

published 2019-07-22

CVE-2019-12324: A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP…

Priority P3 47 high 7.2 CVSS 3.0

AV N AC L PR H UI N S U C H I H A H

A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
akuvox	sp-r50p_firmware	—	—

CVSS provenance

nvd v3.0 7.2 HIGH CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78