CVE-2014-9563

CRLF injection vulnerability in the web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allows remote authenticated users to modify the root password and consequently access the debug port using the serial interface via the ssh-password parameter to page.cmd.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:unify:openstage_sip:*:*:*:*:*:*:*:*
OR cpe:2.3:h:unify:openstage_20:-:*:*:*:*:*:*:*
cpe:2.3:h:unify:openstage_40:-:*:*:*:*:*:*:*
cpe:2.3:h:unify:openstage_60:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:a:unify:openscape_desk_phone_ip_sip:*:*:*:*:*:*:*:*
OR cpe:2.3:h:atos:openscape_desk_phone_ip_35g:-:*:*:*:*:*:*:*
cpe:2.3:h:atos:openscape_desk_phone_ip_35g_eco:-:*:*:*:*:*:*:*
cpe:2.3:h:atos:openscape_desk_phone_ip_55g:-:*:*:*:*:*:*:*

History

21 Nov 2024, 02:21

Type Values Removed Values Added
References () https://networks.unify.com/security/advisories/OBSO-1501-02.pdf - Vendor Advisory () https://networks.unify.com/security/advisories/OBSO-1501-02.pdf - Vendor Advisory
References () https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt - Third Party Advisory () https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt - Third Party Advisory

09 Sep 2021, 17:12

Type Values Removed Values Added
CPE cpe:2.3:h:unify:openscape_desk_phone_ip_55g:-:*:*:*:*:*:*:*
cpe:2.3:h:unify:openscape_desk_phone_ip_35g:-:*:*:*:*:*:*:*
cpe:2.3:h:unify:openscape_desk_phone_ip_35g_eco:-:*:*:*:*:*:*:*
cpe:2.3:h:atos:openscape_desk_phone_ip_55g:-:*:*:*:*:*:*:*
cpe:2.3:h:atos:openscape_desk_phone_ip_35g_eco:-:*:*:*:*:*:*:*
cpe:2.3:h:atos:openscape_desk_phone_ip_35g:-:*:*:*:*:*:*:*

Information

Published : 2018-04-12 21:29

Updated : 2024-11-21 02:21


NVD link : CVE-2014-9563

Mitre link : CVE-2014-9563

CVE.ORG link : CVE-2014-9563


JSON object : View

Products Affected

unify

  • openstage_sip
  • openstage_40
  • openscape_desk_phone_ip_sip
  • openstage_20
  • openstage_60

atos

  • openscape_desk_phone_ip_55g
  • openscape_desk_phone_ip_35g
  • openscape_desk_phone_ip_35g_eco
CWE
CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')