CVE-2018-19978
HIGHAuerswald COMfort 1200 IP phone <3.4.4.1-10589 - Buffer Overflow
Title source: llmDescription
A buffer overflow vulnerability in the DHCP and PPPOE configuration interface of the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows a remote attacker (authenticated as simple user in the same network as the device) to trigger remote code execution via a POST request (ManufacturerName parameter) to the web server on the device. The web server is running with root privileges and the injected code will also run with root privileges.
References (2)
Core 2
Core References
Product, Vendor Advisory x_refsource_misc
https://www.auerswald.de/de/service/81-telefone/schnurgebundene-telefone/1568-comfortel-1200-ip.html
Exploit, Third Party Advisory x_refsource_misc
https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Auerswald_COMfortel_1200_IP.pdf?_=1549376183
Scores
CVSS v3
8.0
EPSS
0.0409
EPSS Percentile
89.5%
Attack Vector
ADJACENT_NETWORK
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-119
Status
published
Products (1)
auerswald/comfortel_1200_ip_firmware
3.4.4.1-10589
Published
May 29, 2019
Tracked Since
Feb 18, 2026