Ericssonlg iPECS Privilege Escalation Vulnerability

A vulnerability in the web-based management interface of iPECS could allow an authenticated, remote attacker to get administrator permission. The vulnerability is due to insecure permission when handling session cookies. An attacker could exploit this vulnerability by modification the cookie value to an affected device. A successful exploit could allow the attacker access to sensitive device information, which includes configuration files.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

特权定义了不安全动作

Ericsson-LG iPECS 安全漏洞

iPECS是韩国Ericsson-LG的一种基于IP技术的企业通信解决方案，旨在提供可靠、灵活和全面的通信功能，帮助中小型企业实现高效的内部和外部沟通。 Ericsson-LG iPECS存在安全漏洞，该漏洞源于处理会话cookie时权限不安全，攻击者可以利用该漏洞修改cookie值从而影响相关设备或者获取设备的敏感信息。

N/A

N/A