Strix
26.1K

CVE-2018-19978

UnknownEPSS 4.09%

Last modified

CVE-2018-19978 is a vulnerability of currently unknown severity. A buffer overflow vulnerability in the DHCP and PPPOE configuration interface of the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows a remote attacker (authenticated as simple user in the same network as the device) to trigger remote code execution via a POST request (ManufacturerName parameter) to the web server on the device. The web server is running with root privileges and the injected code will also run with root privileges.. EPSS estimates a 4.09% chance of exploitation in the next 30 days.

Description

A buffer overflow vulnerability in the DHCP and PPPOE configuration interface of the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows a remote attacker (authenticated as simple user in the same network as the device) to trigger remote code execution via a POST request (ManufacturerName parameter) to the web server on the device. The web server is running with root privileges and the injected code will also run with root privileges.

Metrics

EPSS Probability
4.09%

89.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
AuerswaldComfortel 1200 Ip Firmware3.4.4.1-10589

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2018-19978?
A buffer overflow vulnerability in the DHCP and PPPOE configuration interface of the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows a remote attacker (authenticated as simple user in the same network as the device) to trigger remote code execution via a POST request (ManufacturerName parameter) to the web server on the device. The web server is running with root privileges and the injected code will also run with root privileges.
How severe is CVE-2018-19978?
Severity scoring for CVE-2018-19978 is pending analysis. The EPSS model estimates a 4.09% probability of exploitation in the next 30 days.
How do I fix CVE-2018-19978?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2018

View all 2018CVEs →

Are you affected by CVE-2018-19978?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST