Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if in

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• nec sl1100 firmware7.0 and later
• nec sl2100 firmware7.0 and later
• nec sv8100 firmware7.0 and later
• nec sv9100 firmware7.0 and later

Other highest-scoring records for the same primary product.

• CVE-2019-20033On Aspire-derived NEC PBXes, including all versions of SV8100 devices, a set of documented, static login credentials may be used to access t
  39Monitor
• CVE-2019-20029An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXes, including all versions of
  35Monitor
• CVE-2019-20028Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL2100 devices allow unauthenticate
  30Monitor
• CVE-2019-20032An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all ve
  26Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Authentication is added route by route instead of being enforced in one place. When a route added later bypasses the shared middleware, the session check never runs for it.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use("/admin", requireSession, adminRouter);2
3// Route added later skips the middleware4app.post("/admin-api/config", updateConfig);

1const admin = express.Router();2admin.use(requireSession, requireRole("admin"));3
4admin.post("/config", updateConfig);5app.use("/admin", admin);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.