Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-12325: Htek UC902 phone web UI can be crashed or hijacked

CVE-2019-12325 · published 7 years ago

Summary

The web management page of the Htek UC902 VoIP phone running firmware version 2.0.4.4.46 can be forced to stop working or be taken over. An attacker can shut the phone down without logging in, and a logged‑in user could run commands as the system administrator. Update the firmware to a safe version or disable the web interface until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
htek	uc902_firmware	2.0.4.4.46 `cpe:2.3:o:htek:uc902_firmware:2.0.4.4.46:::::::*`

Original advisory text

The Htek UC902 VoIP phone web management interface contains several buffer overflow vulnerabilities in the firmware version 2.0.4.4.46, which allow an attacker to crash the device (DoS) without authentication or execute code (authenticated as a user) to spawn a remote shell as a root user.

References

https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Htek_UC902.pdf Exploit Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

2% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published22 Jul 2019

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-12325 · NVD

Track software like this

Free during beta