CVE-2014-8421

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-12 · updated 2026-06-17
Weakness: CWE-264

Description

Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allow remote attackers to gain super-user privileges by leveraging SSH access and incorrect ownership of (1) ConfigureCoreFile.sh, (2) Traceroute.sh, (3) apps.sh, (4) conversion_java2native.sh, (5) coreCompression.sh, (6) deletePasswd.sh, (7) findHealthSvcFDs.sh, (8) fw_printenv.sh, (9) fw_setenv.sh, (10) hw_wd_kicker.sh, (11) new_rootfs.sh, (12) opera_killSnmpd.sh, (13) opera_startSnmpd.sh, (14) rebootOperaSoftware.sh, (15) removeLogFiles.sh, (16) runOperaServices.sh, (17) setPasswd.sh, (18) startAccTestSvcs.sh, (19) usbNotification.sh, or (20) appWeb in /Opera_Deploy.

Affected products

Unify Openscape Desk Phone Ip Sip: before r3.32.0 — fixed in r3.32.0
Unify Openstage Sip: before r3.32.0 — fixed in r3.32.0

How to fix

Upgrade to a fixed version: Unify Openscape Desk Phone Ip Sip r3.32.0; Unify Openstage Sip r3.32.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2014-8421 or the next vulnerability affects your stack