Vulnerability CVE-2002-0626


Published: 2003-01-07   Modified: 2012-02-12

Description:
Polycom ViewStation before 7.2.4 has a default null password for the administrator account, which allows arbitrary users to conduct unauthorized activities.

Vendor: Polycom
Product: Viewstation dcp 
Version: 7.2; 6.5.1;
Product: Viewstation sp 384 
Version: 7.2; 6.5.1;
Product: Viewstation v.35 
Version: 7.2; 6.5.1;
Product: Viewstation 128 
Version: 7.2; 6.5.1;
Product: Viewstation h.323 
Version: 7.2; 6.5.1;
Product: Viewstation 512 
Version: 7.2; 6.5.1;
Product: Viewstation mp 
Version: 7.2; 6.5.1;
Product: Viewstation fx vs4000 
Version: 4.1.5;

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
http://www.ciac.org/ciac/bulletins/m-123.shtml
http://www.securityfocus.com/bid/5631
http://www.polycom.com/common/pw_item_show_doc/0,,1444,00.pdf
http://www.iss.net/security_center/static/9347.php
http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21089

Related CVE
CVE-2019-14259
On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the "Time Service Settings web" interface allows an authenticated remote attacker in the same n...
CVE-2019-10689
VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides insufficient authentication between the BToE application and the BToE component, resulting in...
CVE-2018-15128
An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier. A remote code execution vulnerability exists in the content sharing functionality because of a Buffer Overflow via crafted packet...
CVE-2019-10688
VVX products with software versions including and prior to, UCS 5.9.2 with Better Together over Ethernet Connector (BToE) application 3.9.1, use hard-coded credentials to establish connections between the host application and the device.
CVE-2018-18568
Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Busine...
CVE-2018-18566
The SIP service in Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allow remote attackers to obtain sensitive phone configuration information by leveraging use with an on-premise installation with Skype for Business.
CVE-2018-7565
CSRF exists on Polycom QDX 6000 devices.
CVE-2018-7564
Stored XSS exists on Polycom QDX 6000 devices.

Copyright 2019, cxsecurity.com

 

Back to Top