CVE-2014-2650
Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection...
Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface
- Record
CVE-2014-2650- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface
- Record
CVE-2014-2650- Updated
- 2026-11-02
EUVDEUVD-2014-2682 No score
Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface
- Record
EUVD-2014-2682- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2rm4-vgjw-r4jw No score
Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection...
Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface
- Record
GHSA-2rm4-vgjw-r4jw- Updated
- 2026-11-02
Affected products
- atos openscape desk phone ip 35g eco firmware
- atos openscape desk phone ip 35g firmware
- atos openscape desk phone ip 55g firmware
- atos openstage 15 firmware
- atos openstage 15 g firmware
- atos openstage 20 e firmware
- atos openstage 20 firmware
- atos openstage 20 g firmware
- atos openstage 40 firmware
- atos openstage 40 g firmware
- atos openstage 5 firmware
- atos openstage 60 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2650 is a critical vulnerability (CVSS 9.8) in Atos Openscape Desk Phone Ip 35g Eco Firmware, published January 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.57%, the 85th percentile. No source names a fixed version.