A command injection (missing input validation) issue in the IP address field for the…
Priority LOW 39CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request.
Why it matters now
EPSS 0.04343 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12324
- 2026-10-03 Alias added: GHSA-fvrw-43j5-v43w
More Akuvox Sp-r50p Firmware vulnerabilities
- TI-2019-09191 Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP… CVSS 3.0CRITICAL 9.8
- TI-2019-09192 Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2019-12324 · CVE Program
- CVE-2019-12324 · NVD
- FIRST EPSS
- GHSA-fvrw-43j5-v43w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences