CVE-2019-20025

Certain builds of NEC SV9100 software could allow an unauthenticated, remote attacker to log into a device running an affected release with a hardcoded username and password, aka a Static Credential Vulnerability. The vulnerability is due to an undocumented user account with manufacturer privilege level. An attacker could exploit this vulnerability by using this account to remotely log into an affected device. A successful exploit could allow the attacker to log into the device with manufacturer level access. This vulnerability affects SV9100 PBXes that are running software release 6.0 or higher. This vulnerability does not affect SV9100 software releases prior to 6.0.

• CWE-798

• https://shadytel.su/files/nec_cve.txtThird Party Advisory
• https://shadytel.su/files/nec_cve.txtThird Party Advisory

Published

Jul 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-20019An attempted excessive memory allocation was discovered in M…6.5
• CVE-2019-20020A stack-based buffer over-read was discovered in ReadNextStr…6.5
• CVE-2019-20021A heap-based buffer over-read was discovered in canUnpack in…5.5
• CVE-2019-20022An invalid memory address dereference was discovered in load…6.5
• CVE-2019-20023A memory leak was discovered in image_buffer_resize in froms…6.5
• CVE-2019-20024A heap-based buffer overflow was discovered in image_buffer_…6.5
• CVE-2019-20026The WebPro interface in NEC SV9100 software releases 7.0 or …7.5
• CVE-2019-20027Aspire-derived NEC PBXes, including the SV8100, SV9100, SL11…9.8
• CVE-2019-20028Aspire-derived NEC PBXes operating InMail software, includin…7.5
• CVE-2019-20029An exploitable privilege escalation vulnerability exists in …8.8
• CVE-2019-2003In addLinks of Linkify.java, there is a possible phishing ve…
• CVE-2019-20030An attacker with knowledge of the modem access number on a N…7.8