CVE-2018-18567 Weak cryptography in n/a
Man-in-the-middle attackers can steal credentials from AudioCodes phones due to missing X.509 certificate validation in specific Skype for Business setups.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-18567?
CVE-2018-18567 is a medium-severity vulnerability in n/a, published on 24 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AudioCodes 440HD and 450HD devices 3.1.2.89 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.
Weakness: CWE-295
Which versions are affected by CVE-2018-18567?
It affects 2 products.
Products include Audiocodes 440hd Firmware, Audiocodes 450hd Firmware.
How do I fix CVE-2018-18567?
No fix has been published for CVE-2018-18567 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-18567 being exploited?
There is no known exploitation of CVE-2018-18567 in the wild and no public exploit code.
Sources
Also known as GHSA-8vph-24qm-4xg2.