alcatel-lucent omnipcx vulnerabilities and exploits

(subscribe to this query)

5.8

CVSSv2

Multiple stack-based buffer overflows in unspecified CGI programs in the Unified Maintenance Tool web interface in the embedded web server in the Communication Server (CS) in Alcatel-Lucent OmniPCX Enterprise before R9.0 H1.301.50 allow remote malicious users to execute arbitrary...

Alcatel-lucent Omnipcx 7.1 Alcatel-lucent Omnipcx Alcatel-lucent Omnipcx 5.0 Alcatel-lucent Omnipcx 7.0 Alcatel-lucent Omnipcx 8.0 Alcatel-lucent Omnipcx 6.2

8.5

CVSSv2

The Communication Server in Alcatel-Lucent OmniPCX Enterprise 7.1 and previous versions caches an IP address during a TFTP request from an IP Touch phone, and uses this IP address as the destination for all subsequent VoIP packets to this phone, which allows remote malicious user...

Alcatel-lucent Omnipcx

10

CVSSv2

cgi-data/FastJSData.cgi in OmniPCX Office with Internet Access services OXO210 prior to 210/091.001, OXO600 prior to 610/014.001, and other versions, allows remote malicious users to execute arbitrary commands and "obtain OXO resources" via shell metacharacters in the i...

Alcatel-lucent Omnipcx Office

1 EDB exploit

10

CVSSv2

Alcatel OmniPCX 4400 installs known user accounts and passwords in the /etc/password file by default, which allows remote malicious users to gain unauthorized access.

Alcatel-lucent Omnipcx 4400

6.2

CVSSv2

FTP service in Alcatel OmniPCX 4400 allows the "halt" user to gain root privileges by modifying root's .profile file.

Alcatel-lucent Omnipcx 4400

2.1

CVSSv2

Alcatel 4400 installs the /chetc/shutdown command with setgid privileges, which allows many different local users to shut down the system.

Alcatel-lucent Omnipcx 4400

7.5

CVSSv2

Alcatel-Lucent IP-Touch Telephone running OmniPCX Enterprise 7.0 and later enables the mini switch by default, which allows malicious users to gain access to the voice VLAN via daisy-chained systems.

Alcatel-lucent Omnipcx 7.0

5

CVSSv2

The Session Initiation Protocol (SIP) implementation in Alcatel OmniPCX Enterprise 5.0 Lx allows remote malicious users to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.

Alcatel-lucent Omnipcx 5.0

4.6

CVSSv2

Alcatel OmniPCX 4400 installs files with world-writable permissions, which allows local users to reconfigure the system and possibly gain privileges.

Alcatel-lucent Omnipcx 4400

10

CVSSv2

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and previous versions allows remote malicious users to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.

Alcatel-lucent Omnipcx 7.1

3 EDB exploits

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook