Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

LifeSize Room appliance allows attackers to skip login

CVE-2011-2762 · published 15 years ago
Summary

The web interface of the LifeSize Room appliance (version LS_RM1_3.5.3) can be tricked into believing a user is already authenticated, letting anyone access the system without a password. This could let remote users view or change settings and data on the video‑conferencing device. Apply the vendor’s security update or patch as soon as it is available and restrict network access to the appliance.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
lifesize lifesize_room_appliance_software ls_rm1_3.5.3
cpe:2.3:a:lifesize:lifesize_room_appliance_software:ls_rm1_3.5.3:*:*:*:*:*:*:*
Original advisory text
The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) allows remote attackers to bypass authentication via unspecified data associated with a "true" authentication status, related to A...
The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) allows remote attackers to bypass authentication via unspecified data associated with a "true" authentication status, related to AMF data and the LSRoom_Remoting.authenticate function in gateway.php.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published2 Sep 2011
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2011-2762 · NVD
Track software like this
Free during beta