Vulnerability Description
CRLF injection vulnerability in the web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allows remote authenticated users to modify the root password and consequently access the debug port using the serial interface via the ssh-password parameter to page.cmd.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Unify | Openstage Sip | < r3.32.0 |
| Unify | Openstage 20 | - |
| Unify | Openstage 40 | - |
| Unify | Openstage 60 | - |
| Unify | Openscape Desk Phone Ip Sip | < r3.32.0 |
| Atos | Openscape Desk Phone Ip 35G | - |
| Atos | Openscape Desk Phone Ip 35G Eco | - |
| Atos | Openscape Desk Phone Ip 55G | - |
Related Weaknesses (CWE)
References
- https://networks.unify.com/security/advisories/OBSO-1501-02.pdfVendor Advisory
- https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txtThird Party Advisory
- https://networks.unify.com/security/advisories/OBSO-1501-02.pdfVendor Advisory
- https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txtThird Party Advisory
FAQ
What is CVE-2014-9563?
CVE-2014-9563 is a vulnerability with a CVSS score of 4.9 (MEDIUM). CRLF injection vulnerability in the web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allows remote authenticated users...
How severe is CVE-2014-9563?
CVE-2014-9563 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-9563?
Check the references section above for vendor advisories and patch information. Affected products include: Unify Openstage Sip, Unify Openstage 20, Unify Openstage 40, Unify Openstage 60, Unify Openscape Desk Phone Ip Sip.