Critical severity · published Oct 22, 2019
CVE-2019-12147
The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username field
9.8
CVSS
2.6%
EPSS
No
On KEV
Description
The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username field. Upon successful exploitation, a remote unauthenticated user can create a local system user with sudo privileges, and use that user to login to the system (either via the web interface or via SSH) to achieve complete compromise of the device. This affects /var/webconfig/gui/Webconfig.inc.php and /usr/local/sng/bin/sng-user-mgmt.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
Session Border Controller Firmware · Sangoma
2.3.23-119-ga · source: NVD
Affected product
SB
Session Border Controller Firmware
Sangoma
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12147
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12147
Exploit
http://packetstormsecurity.com/files/154914/Sangoma-SBC-2.3.23-119-GA-Unauthenticated-User-Creation.html
Exploit
http://seclists.org/fulldisclosure/2019/Oct/40
Not Applicable
https://blog.appsecco.com
More from Session Border Controller Firmware
9.8
CVE-2019-12148
The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerability involving special…