CVE-2014-8422

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-8422
The web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://networks.unify.com/security/advisories/OBSO-1501-02.pdf Mitigation Vendor Advisory
https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt Third Party Advisory
https://networks.unify.com/security/advisories/OBSO-1501-02.pdf Mitigation Vendor Advisory
https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:unify:openstage_sip:*:*:*:*:*:*:*:*
OR cpe:2.3:h:unify:openstage_20:-:*:*:*:*:*:*:*
cpe:2.3:h:unify:openstage_40:-:*:*:*:*:*:*:*
cpe:2.3:h:unify:openstage_60:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:a:unify:openscape_desk_phone_ip_sip:*:*:*:*:*:*:*:*
OR cpe:2.3:h:atos:openscape_desk_phone_ip_35g:-:*:*:*:*:*:*:*
cpe:2.3:h:atos:openscape_desk_phone_ip_35g_eco:-:*:*:*:*:*:*:*
cpe:2.3:h:atos:openscape_desk_phone_ip_55g:-:*:*:*:*:*:*:*
History

21 Nov 2024, 02:19

Type Values Removed Values Added
References () https://networks.unify.com/security/advisories/OBSO-1501-02.pdf - Mitigation, Vendor Advisory () https://networks.unify.com/security/advisories/OBSO-1501-02.pdf - Mitigation, Vendor Advisory
References () https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt - Third Party Advisory () https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt - Third Party Advisory

09 Sep 2021, 17:49

Type Values Removed Values Added
CPE cpe:2.3:h:unify:openscape_desk_phone_ip_55g:-:*:*:*:*:*:*:*
cpe:2.3:h:unify:openscape_desk_phone_ip_35g:-:*:*:*:*:*:*:*
cpe:2.3:h:unify:openscape_desk_phone_ip_35g_eco:-:*:*:*:*:*:*:*		 cpe:2.3:h:atos:openscape_desk_phone_ip_55g:-:*:*:*:*:*:*:*
cpe:2.3:h:atos:openscape_desk_phone_ip_35g_eco:-:*:*:*:*:*:*:*
cpe:2.3:h:atos:openscape_desk_phone_ip_35g:-:*:*:*:*:*:*:*
Information

Published : 2018-04-12 21:29

Updated : 2024-11-21 02:19

NVD link : CVE-2014-8422

Mitre link : CVE-2014-8422

CVE.ORG link : CVE-2014-8422

JSON object : View

Products Affected

unify

  • openstage_sip
  • openstage_40
  • openscape_desk_phone_ip_sip
  • openstage_20
  • openstage_60

atos

  • openscape_desk_phone_ip_55g
  • openscape_desk_phone_ip_35g
  • openscape_desk_phone_ip_35g_eco
CWE
CWE-331

Insufficient Entropy