On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the 'Time Service Settings web' interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.Īn issue was discovered in Poly (formerly Polycom) HDX 3.1.13. The SIP service in Polycom VVX 500 and 601 devices 5.8 and earlier allow remote attackers to obtain sensitive phone configuration information by leveraging use with an on-premise installation with Skype for Business.Ģ Realpresence Debut, Realpresence Debut FirmwareĪn issue was discovered in versions earlier than 1.3.0-66872 for Polycom RealPresence Debut that allows attackers to arbitrarily read the admin user's password via the admin web UI.Ģ Obihai Obi1022, Obihai Obi1022 Firmware Polycom VVX 500 and 601 devices 5.8 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.

Poly VVX 400/410 5.3.1 allows low-privileged users to change the Admin password by modifying a POST parameter to 120 during the password reset process.ĥ Unified Communications Software, Vvx 500, Vvx 500 Firmware and 2 more 4 Vvx 400, Vvx 400 Firmware, Vvx 410 and 1 more

Polycom btoe client