CVE-2018-18568

Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.

Score

CVSS 3.1 5.9 Medium

Status

Modified - cve@mitre.org

Published

2018-10-24

Last modified

2024-08-05

Weaknesses

CWE-295

Affected products

• Unified Communications Software (Polycom)
• Vvx 500 Firmware (Polycom)
• Vvx 601 Firmware (Polycom)

References

• https://seclists.org/bugtraq/2018/Oct/36
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-027.txt