Unscored CVE-2018-18567 EUVD-2018-10287GHSA-8vph-24qm-4xg2

AudioCodes 440HD and 450HD devices 3.1.2.89 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by le…

Published Oct 24, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Description

AudioCodes 440HD and 450HD devices 3.1.2.89 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.

References

1041956 vdb-entry
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-026.txt
20181023 [SYSS-2018-026] missing X.509 validation with AudioCodes IP Phones (Skype for Business, on-premise) - CVE-2018-18567 mailing-list