Vulnerability Description
The web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Unify | Openstage Sip | < r3.32.0 |
| Unify | Openstage 20 | - |
| Unify | Openstage 40 | - |
| Unify | Openstage 60 | - |
| Unify | Openscape Desk Phone Ip Sip | < r3.32.0 |
| Atos | Openscape Desk Phone Ip 35G | - |
| Atos | Openscape Desk Phone Ip 35G Eco | - |
| Atos | Openscape Desk Phone Ip 55G | - |
Related Weaknesses (CWE)
References
- https://networks.unify.com/security/advisories/OBSO-1501-02.pdfMitigationVendor Advisory
- https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txtThird Party Advisory
- https://networks.unify.com/security/advisories/OBSO-1501-02.pdfMitigationVendor Advisory
- https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txtThird Party Advisory
FAQ
What is CVE-2014-8422?
CVE-2014-8422 is a vulnerability with a CVSS score of 8.1 (HIGH). The web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes ...
How severe is CVE-2014-8422?
CVE-2014-8422 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-8422?
Check the references section above for vendor advisories and patch information. Affected products include: Unify Openstage Sip, Unify Openstage 20, Unify Openstage 40, Unify Openstage 60, Unify Openscape Desk Phone Ip Sip.