What’s Vulnerable › Vulnerabilities

CVE-2014-9563

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-04-12 · updated 2026-06-17
• Weakness: CWE-93

Description

CRLF injection vulnerability in the web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allows remote authenticated users to modify the root password and consequently access the debug port using the serial interface via the ssh-password parameter to page.cmd.

Affected products

• Unify Openscape Desk Phone Ip Sip: before r3.32.0 — fixed in r3.32.0
• Unify Openstage Sip: before r3.32.0 — fixed in r3.32.0

How to fix

Upgrade to a fixed version: Unify Openscape Desk Phone Ip Sip r3.32.0; Unify Openstage Sip r3.32.0. Check the vendor advisory for mitigations.

References

• https://networks.unify.com/security/advisories/OBSO-1501-02.pdf
• https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt
• https://networks.unify.com/security/advisories/OBSO-1501-02.pdf
• https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt

Get alerted when CVE-2014-9563 or the next vulnerability affects your stack