Nec SV9100 Firmware vulnerabilities

6 CVEs affecting Nec SV9100 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-20032, published 2020-07-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-20025, published 2020-07-29. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. Certain builds of NEC SV9100 software could allow an unauthenticated, remote attacker to log into a device running an affected release with a hardcoded username and password, aka a Static Credential…
CVE-2019-20029, published 2020-07-29. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices. A specially…
CVE-2019-20027, published 2020-07-29. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if incorrectly configured to allow a blank username and password…
CVE-2019-20026, published 2020-07-29. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. The WebPro interface in NEC SV9100 software releases 7.0 or higher allows unauthenticated remote attackers to reset all existing usernames and passwords to default values via a crafted request.
CVE-2019-20028, published 2020-07-29. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL2100 devices allow unauthenticated read-only access to voicemails, greetings, and voice…
CVE-2019-20032, published 2020-07-29. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices, may…