Vulnerability Summary
A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.
Details
CVE 2019-12948
A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.
Poly released a firmware update to address this vulnerability. There is no workaround.
Published
Last Update: 3/7/2022
Initial Public Release: 7/26/2019
Advisory ID: PLYVC19-06
CVE ID: CVE-2019-12948
CVSS Score: 8.3
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Product Affected
| PRODUCTS | FIRMWARE | FIX |
|---|---|---|
| VVX300, VVX310, VVX400, VVX410, VVX500 and VVX600 | Prior to:
|
Update to:
|
VVX201, VVX301, VVX311, VVX401, VVX411, VVX501, VVX601, VVX150, VVX250, VVX350 and VVX450 SoundStructure |
Prior to:
|
Update to:
|
| Trio | Prior to:
|
Update to:
|
SoundPoint SoundStation |
Prior to:
|
Update to:
|
Solution
Poly recommends customers upgrade to the respective firmware build identified in the table or later.
Workaround
There is no workaround.
Contact
Any customer using an affected system who is concerned about this vulnerability within their deployment should contact Poly Technical Support – (888) 248-4143, (916) 928-7561, or visit the Poly Support Site.
Revision History
| VERSION | DATE | DESCRIPTION |
|---|---|---|
| 1.0 | 7/26/2019 | Initial Release |
| 1.1 | 8/2/2019 | Modified Page Break |
| 1.2 | 12/20/2019 | Updated Software Version for UCS 4.1.1 |
| 2.0 | 3/7/2022 | Format Changes |