CVE-2019-20031
CRITICALCVSS 9.1/10EPSS 1.00%
Last modified
CVE-2019-20031 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts in the telephone user interface (TUI), effectively allowing brute force attacks.. EPSS estimates a 1.00% chance of exploitation in the next 30 days.
Description
NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts in the telephone user interface (TUI), effectively allowing brute force attacks.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nec | Um8000 Firmware | All versions |
| Nec | Um4730 Firmware | All versions |
References
- https://shadytel.su/files/nec_cve.txtThird Party Advisory
- https://shadytel.su/files/nec_cve.txtThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-20031?
NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts in the telephone user interface (TUI), effectively allowing brute force attacks.
How severe is CVE-2019-20031?
CVE-2019-20031 has a CVSS score of 9.1/10 (CRITICAL severity). The EPSS model estimates a 1.00% probability of exploitation in the next 30 days.
How do I fix CVE-2019-20031?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-20026The WebPro interface in NEC SV9100 software releases 7.0 or …7.5
- CVE-2019-20027Aspire-derived NEC PBXes, including the SV8100, SV9100, SL11…9.8
- CVE-2019-20028Aspire-derived NEC PBXes operating InMail software, includin…7.5
- CVE-2019-20029An exploitable privilege escalation vulnerability exists in …8.8
- CVE-2019-2003In addLinks of Linkify.java, there is a possible phishing ve…
- CVE-2019-20030An attacker with knowledge of the modem access number on a N…7.8
- CVE-2019-20032An attacker with access to an InMail voicemail box equipped …6.5
- CVE-2019-20033On Aspire-derived NEC PBXes, including all versions of SV810…9.8
- CVE-2019-2004In publishKeyEvent, publishMotionEvent and sendUnchainedFini…
- CVE-2019-20041wp_kses_bad_protocol in wp-includes/kses.php in WordPress be…9.8
- CVE-2019-20042In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the…6.1
- CVE-2019-20043In in wp-includes/rest-api/endpoints/class-wp-rest-posts-con…4.3
Are you affected by CVE-2019-20031?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST