Vulnerability Details CVE-2019-12326
Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload (shell commands within the file) and trigger code execution.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.016
EPSS Ranking 80.7%
CVSS Severity
CVSS v3 Score 7.2
CVSS v2 Score 10.0
References
Products affected by CVE-2019-12326
-
cpe:2.3:h:akuvox:sp-r50p:-
-
cpe:2.3:o:akuvox:sp-r50p_firmware:50.0.6.156