CVE-2015-8251 : OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 4

OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape Desk Phone IP 35G SIP V3, OpenScape Desk Phone IP 35G Eco SIP V3, OpenStage 60 and OpenScape Desk Phone IP 55G HFA V3, OpenStage 15, 20E, 20, and 40 and OpenScape Desk Phone IP 35G HFA V3, and OpenScape Desk Phone IP 35G Eco HFA V3 use non-unique X.509 certificates and SSH host keys.

Published 2017-09-25 21:29:01

Updated 2017-10-11 17:53:34

Source CERT/CC

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2015-8251

Unify » Openstage 60 Firmware » Version: 3.0
cpe:2.3:o:unify:openstage_60_firmware:3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Unify » Openstage 60 » Version: N/A
Unify » Openscape Desk Phone Ip 55g Sip Firmware » Version: 3.0
cpe:2.3:o:unify:openscape_desk_phone_ip_55g_sip_firmware:3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Unify » Openscape Desk Phone Ip 55g Sip » Version: N/A
Unify » Openstage 15 Firmware » Version: 3.0
cpe:2.3:o:unify:openstage_15_firmware:3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Unify » Openstage 15 » Version: N/A
Unify » Openstage 20e Firmware » Version: 3.0
cpe:2.3:o:unify:openstage_20e_firmware:3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Unify » Openstage 20e » Version: N/A
Unify » Openstage 20 Firmware » Version: 3.0
cpe:2.3:o:unify:openstage_20_firmware:3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Unify » Openstage 20 » Version: N/A
Unify » Openstage 40 Firmware » Version: 3.0
cpe:2.3:o:unify:openstage_40_firmware:3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Unify » Openstage 40 » Version: N/A
Unify » Openscape Desk Phone Ip 35g Sip Firmware » Version: 3.0
cpe:2.3:o:unify:openscape_desk_phone_ip_35g_sip_firmware:3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Unify » Openscape Desk Phone Ip 35g Sip » Version: N/A
Unify » Openscape Desk Phone Ip 35g Eco Sip Firmware » Version: 3.0
cpe:2.3:o:unify:openscape_desk_phone_ip_35g_eco_sip_firmware:3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Unify » Openscape Desk Phone Ip 35g Eco Sip » Version: N/A
Unify » Openscape Desk Phone Ip 55g Hfa Firmware » Version: 3.0
cpe:2.3:o:unify:openscape_desk_phone_ip_55g_hfa_firmware:3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Unify » Openscape Desk Phone Ip 55g Hfa » Version: N/A
Unify » Openscape Desk Phone Ip 35g Hfa Firmware » Version: 3.0
cpe:2.3:o:unify:openscape_desk_phone_ip_35g_hfa_firmware:3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Unify » Openscape Desk Phone Ip 35g Hfa » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2015-8251

EPSS FAQ

0.29%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 68 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-8251

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.9	MEDIUM	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	2.2	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2015-8251

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-8251

http://www.kb.cert.org/vuls/id/566724

VU#566724 - Embedded devices use non-unique X.509 certificates and SSH host keys
Third Party Advisory;US Government Resource

CVEs referencing this url
https://www.kb.cert.org/vuls/id/BLUU-A2PPZE

VU#566724 - Embedded devices use non-unique X.509 certificates and SSH host keys
Third Party Advisory;US Government Resource
https://networks.unify.com/security/advisories/OBSO-1511-02-A.pdf

Vendor Advisory
https://networks.unify.com/security/advisories/OBSO-1511-02.pdf

Vendor Advisory

Jump to

Vulnerability Details : CVE-2015-8251

Products affected by CVE-2015-8251

Exploit prediction scoring system (EPSS) score for CVE-2015-8251

CVSS scores for CVE-2015-8251

CWE ids for CVE-2015-8251

References for CVE-2015-8251