What’s Vulnerable › Vulnerabilities

CVE-2019-14260

• Severity: high (CVSS 8.0 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-08-01 · updated 2026-06-17
• Weakness: CWE-78

Description

On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.

Affected products

• Al-Enterprise 8008 Firmware: 1.50.13

References

• https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Alcatel_8008CloudEditionDeskPhone.pdf?_=1559026340
• https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Alcatel_8008CloudEditionDeskPhone.pdf?_=1559026340

Get alerted when CVE-2019-14260 or the next vulnerability affects your stack