Akuvox
12 CVEs across 32 Akuvox products. Browse Akuvox vulnerabilities, severities, and proof-of-concept exploits.
Akuvox products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-58337 | Medium | 4.3 | 2025-12-30 | Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configu… |
CVE-2024-58336 | Medium | 5.3 | 2025-12-30 | Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requesting the video.cgi endp… |
CVE-2023-0344 | Critical | 9.1 | 2023-03-31 | Akuvox E11 appears to be using a custom version of dropbear SSH server. This server allows an insecure option that by default is not in the official dropbear S… |
CVE-2023-0343 | Medium | 6.5 | 2023-03-31 | Akuvox E11 contains a function that encrypts messages which are then forwarded. The IV vector and the key are static, and this may allow an attacker to decrypt… |
CVE-2023-0354 | Critical | 9.1 | 2023-03-13 | The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create… |
CVE-2023-0353 | High | 7.2 | 2023-03-13 | Akuvox E11 uses a weak encryption algorithm for stored passwords and uses a hard-coded password for decryption which could allow the encrypted passwords to be… |
CVE-2023-0352 | Critical | 9.1 | 2023-03-13 | The Akuvox E11 password recovery webpage can be accessed without authentication, and an attacker could download the device key file. An attacker could then use… |
CVE-2023-0351 | High | 8.8 | 2023-03-13 | The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload file… |
CVE-2023-0350 | Medium | 6.5 | 2023-03-13 | Akuvox E11 does not ensure that a file extension is associated with the file provided. This could allow an attacker to upload a file to the device by changing… |
CVE-2023-0349 | High | 7.5 | 2023-03-13 | The Akuvox E11 libvoice library provides unauthenticated access to the camera capture for image and video. This could allow an attacker to view and record imag… |
CVE-2023-0348 | High | 7.5 | 2023-03-13 | Akuvox E11 allows direct SIP calls. No access control is enforced by the SIP servers, which could allow an attacker to contact any device within Akuvox to call… |
CVE-2023-0347 | High | 7.5 | 2023-03-13 | The Akuvox E11 Media Access Control (MAC) address, a primary identifier, combined with the Akuvox E11 IP address, could allow an attacker to identify the devic… |
CVE-2023-0346 | High | 7.5 | 2023-03-13 | Akuvox E11 cloud login is performed through an unencrypted HTTP connection. An attacker could gain access to the Akuvox cloud and device if the MAC address of… |
CVE-2023-0345 | Critical | 9.8 | 2023-03-13 | The Akuvox E11 secure shell (SSH) server is enabled by default and can be accessed by the root user. This password cannot be changed by the user. |
CVE-2023-0355 | Medium | 6.5 | 2023-03-13 | Akuvox E11 uses a hard-coded cryptographic key, which could allow an attacker to decrypt sensitive information. |
CVE-2021-31726 | Critical | 9.8 | 2021-04-25 | Akuvox C315 115.116.2613 allows remote command Injection via the cfgd_server service. The attack vector is sending a payload to port 189 (default root 0.0.0.0). |
CVE-2019-12327 | High | 7.2 | 2019-07-22 | Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port… |
CVE-2019-12326 | High | 7.2 | 2019-07-22 | Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone f… |
CVE-2019-12324 | High | 7.2 | 2019-07-22 | A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP… |