Vulnerability Description
An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By entering a special character (such as a single quote) in a CN or other CSR field, one can insert a command into a factor value. A system command can be executed as root.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Polycom | Hdx System Software | <= 3.1.13 |
Related Weaknesses (CWE)
References
- https://support.polycom.com/content/dam/polycom-support/global/documentation/hdxPatchVendor Advisory
- https://support.polycom.com/content/dam/polycom-support/global/documentation/hdxPatchVendor Advisory
FAQ
What is CVE-2019-11355?
CVE-2019-11355 is a vulnerability with a CVSS score of 7.2 (HIGH). An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's...
How severe is CVE-2019-11355?
CVE-2019-11355 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-11355?
Check the references section above for vendor advisories and patch information. Affected products include: Polycom Hdx System Software.