Vulnerability Details : CVE-2014-9563
CRLF injection vulnerability in the web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allows remote authenticated users to modify the root password and consequently access the debug port using the serial interface via the ssh-password parameter to page.cmd.
Products affected by CVE-2014-9563
- cpe:2.3:a:unify:openstage_sip:*:*:*:*:*:*:*:*
- cpe:2.3:a:unify:openscape_desk_phone_ip_sip:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-9563
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 34 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-9563
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:P/A:N |
8.0
|
2.9
|
NIST | |
|
4.9
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |
1.2
|
3.6
|
NIST |
CWE ids for CVE-2014-9563
-
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-9563
-
https://networks.unify.com/security/advisories/OBSO-1501-02.pdf
Vendor Advisory
-
https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt
Third Party Advisory
Jump to