CVE-2019-12326 File upload in n/a
Attackers can upload malicious ringtone files to execute arbitrary code on Akuvox R50P VoIP phones due to missing validation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-12326?
CVE-2019-12326 is a high-severity vulnerability in n/a, published on 22 Jul 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload (shell commands within the file) and trigger code execution.
Weakness: CWE-434
Which versions are affected by CVE-2019-12326?
It affects 1 product.
Products include Akuvox Sp-R50p Firmware.
How do I fix CVE-2019-12326?
No fix has been published for CVE-2019-12326 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-12326 being exploited?
There is no known exploitation of CVE-2019-12326 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-w353-q44q-75p3.