Security readout for executives and security teams
Plain-English summary
AudioCodes 405HD VoIP phones running firmware 2.2.12 may let someone on the same network change the administrator password without knowing the current password. That could lock administrators out or give an internal attacker control of phone configuration. The sources do not report internet-wide exposure or active exploitation.
Executive priority
Prioritize affected phones where ordinary users, guests, or compromised workstations share network reachability with phone management interfaces. The business risk is device takeover and administrative lockout, not confirmed public exploitation.
Technical view
The CVE describes missing password verification in the AudioCodes 405HD web interface. A remote attacker on the same network as the device can change the admin password without authentication. Public metadata lists severity, CVSS, CWE, and structured affected-product fields as incomplete or unknown.
Likely exposure
Exposure is most likely in organizations with AudioCodes 405HD phones on reachable voice, office, or management networks, specifically firmware 2.2.12. The source does not establish exposure for other AudioCodes models or firmware versions.
Exploitation context
The source describes unauthenticated admin password change from the same network. CISA KEV is false in the provided bundle, and no cited source reports active exploitation. Treat this mainly as an internal-network or post-access risk unless separate evidence shows broader reachability.
Researcher notes
Evidence is narrow: AudioCodes 405HD firmware 2.2.12 and same-network access. The CVE record lacks CVSS, CWE, and structured affected CPE data. Do not generalize to other models without vendor evidence.
Mitigation direction
- Inventory AudioCodes 405HD phones and identify firmware 2.2.12 devices.
- Check AudioCodes or device support guidance for fixed firmware or replacement direction.
- Restrict the phone web interface to trusted management networks only.
- Block user workstation access to phone administration interfaces where possible.
- Rotate admin credentials after remediation or confirmed isolation.
Validation and detection
- Confirm whether any deployed AudioCodes 405HD phones run firmware 2.2.12.
- Verify the web management interface is not reachable from untrusted LAN segments.
- Review phone administration logs for unexpected password or configuration changes.
- Confirm documented network controls limit access to phone management endpoints.
- Track vendor advisory status before declaring remediation complete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-16219 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_AudioCodes_405HD.pdfCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.