CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 8.5
CWE Name:  Permissions Privileges and Access Controls
Summary: unify (former siemens) openstage sip and openscape desk phone ip v3 devices before r3.32.0 allow remote attackers to gain super-user privileges by leveraging ssh access and incorrect ownership of (1) configurecorefile.sh, (2) traceroute.sh, (3) apps.sh, (4) conversion_java2native.sh, (5) corecompression.sh, (6) deletepasswd.sh, (7) findhealthsvcfds.sh, (8) fw_printenv.sh, (9) fw_setenv.sh, (10) hw_wd_kicker.sh, (11) new_rootfs.sh, (12) opera_killsnmpd.sh, (13) opera_startsnmpd.sh, (14) rebootoperasoftware.sh, (15) removelogfiles.sh, (16) runoperaservices.sh, (17) setpasswd.sh, (18) startacctestsvcs.sh, (19) usbnotification.sh, or (20) appweb in /opera_deploy.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2018-04-12
Last Modified Date: 2018-05-22