Details of VAR-201708-1101

ID

VAR-201708-1101

CVE

CVE-2017-12857

TITLE

Polycom UCS Vulnerable to information disclosure

Trust: 0.8

sources: JVNDB: JVNDB-2017-007687

DESCRIPTION

Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's memory which could contain an administrator's password or other sensitive information. Polycom UCS Contains an information disclosure vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. PolycomSoundStationIP, VVX and RealPresenceTrio are products of Polycom Corporation of the United States. PolycomSoundStationIP is an IP phone; VVX is a video conferencing phone; RealPresenceTrio is a smart multimedia device. An information disclosure vulnerability exists in UCS in PolycomSoundStationIP, VVX, and RealPresenceTrio

Trust: 2.16

sources: NVD: CVE-2017-12857 // JVNDB: JVNDB-2017-007687 // CNVD: CNVD-2017-30594

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2017-30594

AFFECTED PRODUCTS

vendor:	polycom	model:	unified communications software	scope:	lte	version:	5.4.4	Trust: 1.0
vendor:	polycom	model:	unified communications software	scope:	lte	version:	5.5.1	Trust: 1.0
vendor:	polycom	model:	unified communications software	scope:	lte	version:	5.4.6	Trust: 1.0
vendor:	polycom	model:	unified communications software	scope:	lte	version:	4.0.11	Trust: 1.0
vendor:	polycom	model:	unified communications software	scope:	-	version:	-	Trust: 0.8
vendor:	polycom	model:	<ucs	scope:	eq	version:	vvx4.0.12	Trust: 0.6
vendor:	polycom	model:	rev ag	scope:	eq	version:	vvx<5.4.5	Trust: 0.6
vendor:	polycom	model:	-	scope:	eq	version:	vvx<5.4.7	Trust: 0.6
vendor:	polycom	model:	-	scope:	eq	version:	vvx<5.5.2	Trust: 0.6
vendor:	polycom	model:	-	scope:	eq	version:	vvx<5.6.0	Trust: 0.6
vendor:	polycom	model:	realpresence trio <ucs	scope:	eq	version:	4.0.12	Trust: 0.6
vendor:	polycom	model:	realpresence trio rev ag	scope:	lt	version:	5.4.5	Trust: 0.6
vendor:	polycom	model:	realpresence trio	scope:	lt	version:	5.4.7	Trust: 0.6
vendor:	polycom	model:	realpresence trio	scope:	lt	version:	5.5.2	Trust: 0.6
vendor:	polycom	model:	realpresence trio	scope:	lt	version:	5.6.0	Trust: 0.6
vendor:	polycom	model:	soundstation ip rev ag	scope:	lt	version:	5.4.5	Trust: 0.6
vendor:	polycom	model:	soundstation ip <ucs	scope:	eq	version:	4.0.12	Trust: 0.6
vendor:	polycom	model:	soundstation ip	scope:	lt	version:	5.4.7	Trust: 0.6
vendor:	polycom	model:	soundstation ip	scope:	lt	version:	5.5.2	Trust: 0.6
vendor:	polycom	model:	soundstation ip	scope:	lt	version:	5.6.0	Trust: 0.6
vendor:	polycom	model:	unified communications software	scope:	eq	version:	4.0.11	Trust: 0.6
vendor:	polycom	model:	unified communications software	scope:	eq	version:	5.4.4	Trust: 0.6
vendor:	polycom	model:	unified communications software	scope:	eq	version:	5.4.6	Trust: 0.6
vendor:	polycom	model:	unified communications software	scope:	eq	version:	5.5.1	Trust: 0.6

sources: CNVD: CNVD-2017-30594 // JVNDB: JVNDB-2017-007687 // CNNVD: CNNVD-201708-627 // NVD: CVE-2017-12857

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-12857
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-12857
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2017-30594
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201708-627
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2017-12857
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-30594
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2017-12857
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2017-30594 // JVNDB: JVNDB-2017-007687 // CNNVD: CNNVD-201708-627 // NVD: CVE-2017-12857

PROBLEMTYPE DATA

problemtype:

CWE-200

Trust: 1.8

sources: JVNDB: JVNDB-2017-007687 // NVD: CVE-2017-12857

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201708-627

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201708-627

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-007687

PATCH

title:	Security Advisory Relating to Information Disclosure Vulnerability on Polycom UCS-Based Products	url:	http://support.polycom.com/content/dam/polycom-support/global/documentation/security-advisory-information-disclosure-on-polycom-voice-products-v1.0.pdf	Trust: 0.8
title:	Patch for PolycomSoundStationIP, VVX, and RealPresenceTrioUCS Information Disclosure Vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/103969	Trust: 0.6
title:	Polycom SoundStation IP , VVX and RealPresence Trio UCS Repair measures for information disclosure vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74004	Trust: 0.6

sources: CNVD: CNVD-2017-30594 // JVNDB: JVNDB-2017-007687 // CNNVD: CNNVD-201708-627

EXTERNAL IDS

db:	NVD	id:	CVE-2017-12857	Trust: 3.0
db:	SECTRACK	id:	1039309	Trust: 1.0
db:	JVNDB	id:	JVNDB-2017-007687	Trust: 0.8
db:	CNVD	id:	CNVD-2017-30594	Trust: 0.6
db:	CNNVD	id:	CNNVD-201708-627	Trust: 0.6

sources: CNVD: CNVD-2017-30594 // JVNDB: JVNDB-2017-007687 // CNNVD: CNNVD-201708-627 // NVD: CVE-2017-12857

REFERENCES

url:	http://support.polycom.com/content/dam/polycom-support/global/documentation/security-advisory-information-disclosure-on-polycom-voice-products-v1.0.pdf	Trust: 2.2
url:	http://www.securitytracker.com/id/1039309	Trust: 1.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12857	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-12857	Trust: 0.8

sources: CNVD: CNVD-2017-30594 // JVNDB: JVNDB-2017-007687 // CNNVD: CNNVD-201708-627 // NVD: CVE-2017-12857

SOURCES

db:	CNVD	id:	CNVD-2017-30594
db:	JVNDB	id:	JVNDB-2017-007687
db:	CNNVD	id:	CNNVD-201708-627
db:	NVD	id:	CVE-2017-12857

LAST UPDATE DATE

2025-04-20T23:22:13.206000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-30594	date:	2017-10-19T00:00:00
db:	JVNDB	id:	JVNDB-2017-007687	date:	2017-09-28T00:00:00
db:	CNNVD	id:	CNNVD-201708-627	date:	2017-08-28T00:00:00
db:	NVD	id:	CVE-2017-12857	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2017-30594	date:	2017-10-18T00:00:00
db:	JVNDB	id:	JVNDB-2017-007687	date:	2017-09-28T00:00:00
db:	CNNVD	id:	CNNVD-201708-627	date:	2017-08-16T00:00:00
db:	NVD	id:	CVE-2017-12857	date:	2017-08-25T19:29:00.270