What’s Vulnerable › Vulnerabilities

CVE-2019-12948

• Severity: high (CVSS 8.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-07-29 · updated 2026-06-17
• Weakness: CWE-749

Description

A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.

Affected products

• Polycom Unified Communications Software: before 5.8.5.1256; from 5.9.3 before 5.9.3.2857; from 6.0.0 before 6.0.0.4839 — fixed in 5.8.5.1256, 5.9.3.2857, 6.0.0.4839
• Polycom United Communications Software: before 5.9.0; before 4.0.14.1580 — fixed in 4.0.14.1580, 5.9.0

How to fix

Upgrade to a fixed version: Polycom Unified Communications Software 5.8.5.1256, 5.9.3.2857, 6.0.0.4839; Polycom United Communications Software 4.0.14.1580, 5.9.0. Check the vendor advisory for mitigations.

References

• https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf
• https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf

Get alerted when CVE-2019-12948 or the next vulnerability affects your stack