[CVE-2018-10091] Stored XSS vulnerabilities in AudioCode IP phones
The AudioCodes 400HD series of IP phones is a range of easy-to-use, feature-rich desktop devices for the service provider hosted services, enterprise IP telephony and contact center markets. Most of user inputs in the CGI interface are not protected against XSS injections. These vulnerabilities have only been tested on the 420HD phone.Description
The AudioCodes 400HD series of IP phones is a range of easy-to-use, feature-rich desktop devices for the service provider hosted services, enterprise IP telephony and contact center markets.
Most of user inputs in the CGI interface are not protected against XSS injections.
These vulnerabilities have only been tested on the 420HD phone.
Vulnerability records
CVE ID: CVE-2018-10091
Access Vector: remote
Security Risk: medium
Vulnerability: CWE-79
CVSS Base Score: 5.5
CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N/E:H/RC:C
Details
The script mainform.cgi
is vulnerable to multiple stored XSS vulnerabilities.
For example, it is possible to add the following string :
<script>alert("XSS")</script>
within any field (Name
, Office
, Home
or Mobile
) on the Directory
page (used to add contacts). This will trigger JavaScript code execution in the web browser.
The payload gets stored and remains active in the page.
All forms on the web application, where the user input is printed on the page, seem to be vulnerable.
Note that the vulnerable page is only available to authenticated users (in possession of the admin configuration password).
Timeline (dd/mm/yyyy)
- 06/03/2018 : Initial discovery
- 17/04/2018 : Vendor contact
- 17/05/2018 : Vendor technical team acknowledgment
- 15/08/2018 : Vendor submit a private 2.2.16.128 prerelease that, according to our test, did not mitigate the issue.
- 10/01/2019 : Public disclosure
Fixes
AudioCodes allegedly fixed the issue in version 2.2.16.128.
Affected versions
Theses vulnerabilities have only been tested on the 420HD phone (firmware version: 2.2.12.126).
Credits
a.baube at sysdream dot com