VULNERABILITY INTELLIGENCE

CVE-2019-14259

CVSS score8 HIGH
EPSS probability2.80%
CISA KEVNot currently listed
Published2019-08-01
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the "Time Service Settings web" interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.

Weakness classification

  • nvd@nist.gov: CWE-78

Primary references