Device Manager Express vulnerabilities
4 known vulnerabilities in Device Manager Express from AudioCodes. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
Device Manager Express: Improper Neutralization of Special Elements used in a Command
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh POST request with an ssh_command field that is executed.
- 9.8 Critical severity
Device Manager Express: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. An attacker can upload a .php file to
- 7.2 High severity
Device Manager Express: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter of IPPhoneFirmwareEdit.php.
- 9.8 Critical severity
Device Manager Express: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.