CVE-2018-16220 Cross-site scripting in n/a

What is CVE-2018-16220?

CVE-2018-16220 is a medium-severity cross-site scripting vulnerability in n/a, published on 25 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross Site Scripting in different input fields (domain field and personal settings) in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an attacker (local or remote) to inject JavaScript into the web interface of the device by manipulating the phone book entries or manipulating the domain name sent to the device from the domain controller.

Weakness: CWE-79

Which versions are affected by CVE-2018-16220?

It affects 1 product.

Products include Audiocodes 405hd Firmware.

How do I fix CVE-2018-16220?

No fix has been published for CVE-2018-16220 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-16220 being exploited?

There is no known exploitation of CVE-2018-16220 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-16219 Auth bypass in n/a High 8.8
• CVE-2018-16216 Command injection in n/a High 8.0
• CVE-2023-22955 Security feature bypass in n/a High 7.8
• CVE-2023-22956 Hardcoded credentials in n/a High 7.5
• CVE-2023-22957 Hardcoded credentials in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6mrj-35q9-fhgq.