A vulnerability has been found in Auerswald COMfort 1200 IP Phone 3.4.4.1-10589 (IP Phone Software) and classified as critical. Affected by this vulnerability is an unknown code block of the component FTP Upgrade Configuration Interface. The manipulation as part of a POST Request leads to a command injection vulnerability. The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A command injection (missing input validation, escaping) in the ftp upgrade configuration interface on the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows an authenticated remote attacker (simple user) -- in the same network as the device -- to trigger OS commands (like starting telnetd or opening a reverse shell) via a POST request to the web server.

The weakness was shared 05/29/2019. This vulnerability is known as CVE-2018-19977 since 12/08/2018. Access to the local network is required for this attack. The requirement for exploitation is a single authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-135680 is related to this item.

Productinfo

Type

• IP Phone Software

Vendor

• Auerswald

Name

• COMfort 1200 IP Phone

Version

• 3.4.4.1-10589

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion