Nec SV8100 Firmware vulnerabilities

5 CVEs affecting Nec SV8100 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-20033, published 2020-07-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-20029, published 2020-07-29. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices. A specially…
CVE-2019-20027, published 2020-07-29. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if incorrectly configured to allow a blank username and password…
CVE-2019-20033, published 2020-07-29. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. On Aspire-derived NEC PBXes, including all versions of SV8100 devices, a set of documented, static login credentials may be used to access the DIM interface.
CVE-2019-20028, published 2020-07-29. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL2100 devices allow unauthenticated read-only access to voicemails, greetings, and voice…
CVE-2019-20032, published 2020-07-29. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices, may…