The AudioCodes 400HD series of IP phones is a range of easy-to-use, feature-rich desktop devices for the service provider hosted services, enterprise IP telephony and contact center markets.
Most of user inputs in the CGI interface are not protected against XSS injections.
These vulnerabilities have only been tested on the 420HD phone.
CVE ID: CVE-2018-10091
Access Vector: remote
Security Risk: medium
CVSS Base Score: 5.5
CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N/E:H/RC:C
mainform.cgi is vulnerable to multiple stored XSS vulnerabilities.
For example, it is possible to add the following string :
within any field (
Mobile) on the
The payload gets stored and remains active in the page.
All forms on the web application, where the user input is printed on the page, seem to be vulnerable.
Note that the vulnerable page is only available to authenticated users (in possession of the admin configuration password).
- 06/03/2018 : Initial discovery
- 17/04/2018 : Vendor contact
- 17/05/2018 : Vendor technical team acknowledgment
- 15/08/2018 : Vendor submit a private 220.127.116.11 prerelease that, according to our test, did not mitigate the issue.
- 10/01/2019 : Public disclosure
AudioCodes allegedly fixed the issue in version 18.104.22.168.
Theses vulnerabilities have only been tested on the 420HD phone (firmware version: 22.214.171.124).
a.baube at sysdream dot com