CVE-2014-8421

Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allow remote attackers to gain super-user privileges by leveraging SSH access and incorrect ownership of (1) ConfigureCoreFile.sh, (2) Traceroute.sh, (3) apps.sh, (4) conversion_java2native.sh, (5) coreCompression.sh, (6) deletePasswd.sh, (7) findHealthSvcFDs.sh, (8) fw_printenv.sh, (9) fw_setenv.sh, (10) hw_wd_kicker.sh, (11) new_rootfs.sh, (12) opera_killSnmpd.sh, (13) opera_startSnmpd.sh, (14) rebootOperaSoftware.sh, (15) removeLogFiles.sh, (16) runOperaServices.sh, (17) setPasswd.sh, (18) startAccTestSvcs.sh, (19) usbNotification.sh, or (20) appWeb in /Opera_Deploy.

• CWE-264

• https://networks.unify.com/security/advisories/OBSO-1501-02.pdfMitigation, Vendor Advisory
• https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txtThird Party Advisory
• https://networks.unify.com/security/advisories/OBSO-1501-02.pdfMitigation, Vendor Advisory
• https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txtThird Party Advisory

Published

Apr 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-8415Race condition in the chan_pjsip channel driver in Asterisk …
• CVE-2014-8416Use-after-free vulnerability in the PJSIP channel driver in …
• CVE-2014-8417ConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7…
• CVE-2014-8418The DB dialplan function in Asterisk Open Source 1.8.x befor…
• CVE-2014-8419Wibu-Systems CodeMeter Runtime before 5.20 uses weak permiss…
• CVE-2014-8420The ViewPoint web application in Dell SonicWALL Global Manag…
• CVE-2014-8422The web-based management (WBM) interface in Unify (former Si…8.1
• CVE-2014-8423Unspecified vulnerability in the management portal in ARRIS …
• CVE-2014-8424ARRIS VAP2500 before FW08.41 does not properly validate pass…
• CVE-2014-8425The management portal in ARRIS VAP2500 before FW08.41 allows…
• CVE-2014-8426Hard coded weak credentials in Barracuda Load Balancer 5.0.0…
• CVE-2014-8428Privilege escalation vulnerability in Barracuda Load Balance…