Vulnerabilities > Polycom > Unified Communications Software > Medium

DATE CVE VULNERABILITY TITLE RISK
2019-07-29 CVE-2019-12948 Exposed Dangerous Method or Function vulnerability in Polycom products
A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.
network
low complexity
polycom CWE-749
6.5
2019-04-23 CVE-2019-10688 Use of Hard-coded Credentials vulnerability in Polycom products
VVX products with software versions including and prior to, UCS 5.9.2 with Better Together over Ethernet Connector (BToE) application 3.9.1, use hard-coded credentials to establish connections between the host application and the device.
local
low complexity
polycom CWE-798
4.6
2018-10-24 CVE-2018-18568 Improper Certificate Validation vulnerability in Polycom Unified Communications Software
Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.
network
polycom CWE-295
4.3
2018-10-24 CVE-2018-18566 Information Exposure vulnerability in Polycom Unified Communications Software
The SIP service in Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allow remote attackers to obtain sensitive phone configuration information by leveraging use with an on-premise installation with Skype for Business.
network
low complexity
polycom CWE-200
5.0
2017-08-25 CVE-2017-12857 Information Exposure vulnerability in Polycom Unified Communications Software
Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application.
network
low complexity
polycom CWE-200
4.0