Vulnerability Summary
VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides insufficient authentication between the BToE application and the BToE component, resulting in leakage of sensitive information.
Details
CVE 2019-10689
VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides insufficient authentication between the BToE application and the BToE component, resulting in leakage of sensitive information.
Poly released a firmware update to address this vulnerability. There is no workaround.
Published
Last Update: 3/7/2022
Initial Public Release: 6/17/2019
Advisory ID: PLYVC19-05
CVE ID: CVE-1019-10689
CVSS Score: 6.5
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Product Affected
| PRODUCTS | FIRMWARE | FIX |
|---|---|---|
| VVX300, VVX310, VVX400, VVX410, VVX500 and VVX600 | Prior to UCS 5.9.3 with BToE Application 3.9.1 |
UC Software 5.9.3 and above with compatible BToE Application |
| VVX201, VVX301, VVX311, VVX401, VVX411, VVX501 and VVX601 | Prior to UCS 5.9.3 with BToE Application 3.9.1 |
UC Software 5.9.3 and above with compatible BToE Application |
| VVX150, VVX250, VVX350 and VVX450 | Prior to UCS 5.9.3 with BToE Application 3.9.1 |
UC Software 5.9.3 and above with compatible BToE Application |
Solution
Poly recommends customers upgrade to firmware build 5.9.3 or 6.0.0 with compatible BToE application or later respectively.
Workaround
There is no workaround.
Contact
Any customer using an affected system who is concerned about this vulnerability within their deployment should contact Poly Technical Support – (888) 248-4143, (916) 928-7561, or visit the Poly Support Site.
RECOGNITION
Poly would like to thank Timon Hackenjos from FZI Research Center for Information Technology for reporting security vulnerabilities to us and for their coordinated disclosure.
Revision History
| VERSION | DATE | DESCRIPTION |
|---|---|---|
| 1.0 | 6/17/2019 | Initial Release |
| 1.1 | 6/18/2019 | Updated CVE score |
| 2.0 | 3/7/2022 | Format Changes |