FKIE_CVE-2019-12948
Vulnerability from fkie_nvd - Published: 2019-07-29 16:15 - Updated: 2026-06-17 02:15
Severity
Summary
A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.
References
Impacted products
{
"affected": [
{
"affectedData": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"source": "cve@mitre.org"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C625E971-506A-45F3-AD61-2070AEB0162F",
"versionEndExcluding": "5.8.5.1256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DE3B1B9B-3210-44ED-A5F3-6C9C0C800E33",
"versionEndExcluding": "5.9.3.2857",
"versionStartIncluding": "5.9.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*",
"matchCriteriaId": "33A63BC1-CB87-4C99-9549-B1DEB72BE4CC",
"versionEndExcluding": "6.0.0.4839",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:polycom:c12:-:*:*:*:*:*:*:*",
"matchCriteriaId": "79199231-6249-4C12-9400-E1351A7E92BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:c16:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8DAE9212-F081-49BA-8619-6C8A7D99313B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:c8:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBFC659D-A7DF-458A-8161-2AF95954634E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx150:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D1E17290-C123-4A51-AF39-B3BCFCE6FFA3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx201:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9C2D973F-E4CA-4085-AFAF-F3FD48182144",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "620A47C4-7D4D-4C26-A4F6-E95A414996E0",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx301:-:*:*:*:*:*:*:*",
"matchCriteriaId": "ADD18487-B8DF-42C8-A068-6C7C495485C1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx311:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3853AB2F-A836-4964-9E93-4D4B46F4A673",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx350:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E0F28EF6-3F2B-4F0E-8349-F86EF0A65280",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx401:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D822D5C9-8C15-4CE9-AC65-A0C3C76B1F03",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx411:-:*:*:*:*:*:*:*",
"matchCriteriaId": "70824863-4F2C-4619-B5E1-22C4B41C0ADE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx450:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4F721F0B-538B-482F-8A59-CFE4E388281F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx501:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2D54DCE1-77EE-493A-B1B6-9C1D7C952180",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx601:-:*:*:*:*:*:*:*",
"matchCriteriaId": "303F10D5-C6AC-4025-88D6-2368E904F327",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:polycom:united_communications_software:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B5A23ECE-B6DD-4C6F-99C4-3A324947826D",
"versionEndExcluding": "5.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:polycom:trio_8500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F43818E9-D3DE-45A7-8667-7B6B16625B97",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:trio_8800:-:*:*:*:*:*:*:*",
"matchCriteriaId": "48C05AC7-2D6E-4301-B312-EEFF9038EFC0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:polycom:united_communications_software:*:*:*:*:*:*:*:*",
"matchCriteriaId": "382C5E71-16F4-4E76-BC22-01D81BE4D618",
"versionEndExcluding": "4.0.14.1580",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_300:-:*:*:*:*:*:*:*",
"matchCriteriaId": "820C5839-7C52-4B88-90DA-C6C21FEFD0A2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_301:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3D7424D6-2CE0-48A3-AFB0-C5D30819FF8C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_320:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1956CD6A-BF80-4B6F-B07C-311667066BBF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_321:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D22FD3DF-A86C-41C6-A744-685ED5F6609E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_330:-:*:*:*:*:*:*:*",
"matchCriteriaId": "44A5EBB0-BBFE-49DE-8D63-7A7AC59E89C2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_331:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EDA78F69-32BE-4675-A98A-B7FCF40627FB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_335:-:*:*:*:*:*:*:*",
"matchCriteriaId": "90416A73-992C-477D-9E0A-1F5170E9F884",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_430:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8C73B2DB-06ED-44F5-BCBF-214E3EA74CB8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_450:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DDD8F2D8-EBD9-41F7-8FED-13B8E827372C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1983CB3C-E88B-4355-9AF3-34F9D103A06A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_501:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7209DA9E-F392-44D9-A8D7-0403AD483D4F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_550:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8840D5B2-33C8-438C-8C32-6B7702B571D9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_560:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B071EF0-9F8D-4841-912F-41B82A43819D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_600:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B153D064-C831-46AB-BC3C-32601CBDD251",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_601:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B75A9809-5378-4C58-9E5A-909492DD2360",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_650:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EF786C93-9283-40BB-8F6E-F2A1527E8513",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_ip_670:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6757D2C2-8010-4EB9-A0B5-564FD8E1D7F7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_pro_se-220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "424B0E05-DFAC-4AC0-B079-66136051A94E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundpoint_pro_se-225:-:*:*:*:*:*:*:*",
"matchCriteriaId": "99B9F4C3-1965-4278-863B-4DDE46C9BFC4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundstation_duo:-:*:*:*:*:*:*:*",
"matchCriteriaId": "051C3271-88A0-42E2-8A2F-32DF20B5FF6B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundstation_ip_4000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "51B28075-E9F4-41E7-B6DE-222DD5D4A4A6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundstation_ip_5000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F7594DBE-73CA-42F9-9134-F69508BEA110",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundstation_ip_6000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FFCAC7-25C9-4640-8B97-7557BB13E07E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundstation_ip_7000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B9EE2AC3-483B-43FE-B83F-6E19C1D8AFA8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundstation_ip_7000_video_integration:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89ED69EB-7E36-4383-BE2B-BC8FB3F94E3A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundstation_vtx_1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BE5ED780-8889-42F5-8F63-4483E3A56936",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundstation2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "14CAD094-E94C-4581-856E-EB132F16F6C4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundstation2_avaya_2490:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A04ABECE-F4E0-4F16-8BA1-9B7E86FE144C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundstation2_direct_connect_for_nortel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "863AE311-1557-41EC-BBE0-296E25B533E9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:soundstation2w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D02DBC31-14D7-484E-A68F-C5F076CB1CA3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C625E971-506A-45F3-AD61-2070AEB0162F",
"versionEndExcluding": "5.8.5.1256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DE3B1B9B-3210-44ED-A5F3-6C9C0C800E33",
"versionEndExcluding": "5.9.3.2857",
"versionStartIncluding": "5.9.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:polycom:vvx300:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9A36BDB2-1DB7-4D2F-B8AD-609C010B66A8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx310:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F09F121C-EBBF-4B31-829F-6B584539EE0D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx400:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A3882D3C-6A93-4AB6-9B51-2D19571FC45C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx410:-:*:*:*:*:*:*:*",
"matchCriteriaId": "28428904-FFBB-4BEF-ABD2-468D81D675C5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2A64CAE3-6218-4828-BF53-0D61DF0134DE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:polycom:vvx600:-:*:*:*:*:*:*:*",
"matchCriteriaId": "824C0FC8-C91D-4ADE-B105-87C8DD6C3603",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la interfaz de administraci\u00f3n basada en web de los tel\u00e9fonos VVX, Trio, SoundStructure, SoundPoint y SoundStation que ejecutan el software Polycom UC, si se explota, podr\u00eda permitir que un atacante remoto autenticado con privilegios de administrador cause una condici\u00f3n de denegaci\u00f3n de servicio (DoS) o ejecutar c\u00f3digo arbitrario"
}
],
"id": "CVE-2019-12948",
"lastModified": "2026-06-17T02:15:46.690",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.5,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-29T16:15:12.647",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-749"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…