What’s Vulnerable › Vulnerabilities

CVE-2014-8422

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-04-12 · updated 2026-06-17
• Weakness: CWE-331

Description

The web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack.

Affected products

• Unify Openscape Desk Phone Ip Sip: before r3.32.0 — fixed in r3.32.0
• Unify Openstage Sip: before r3.32.0 — fixed in r3.32.0

How to fix

Upgrade to a fixed version: Unify Openscape Desk Phone Ip Sip r3.32.0; Unify Openstage Sip r3.32.0. Check the vendor advisory for mitigations.

References

• https://networks.unify.com/security/advisories/OBSO-1501-02.pdf
• https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt
• https://networks.unify.com/security/advisories/OBSO-1501-02.pdf
• https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt

Get alerted when CVE-2014-8422 or the next vulnerability affects your stack