VULNERABILITY INTELLIGENCE

CVE-2019-14260

CVSS score8 HIGH
EPSS probability2.80%
CISA KEVNot currently listed
Published2019-08-01
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.

Weakness classification

  • nvd@nist.gov: CWE-78

Primary references