OS Command Injection in CURO UC300 IP Phone

An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter.

PoC: https://github.com/restdone/CVE-2025-57457/blob/main/os_commandinject.mp4

Step

1. Login to the admin panel of the UC300 (IP of the phone and port 80)
2. Browse to Network, than Diagnostics
3. Inject OS Command at IP Addr field.
4. Click Start and exeucte the Linux Command on the phone.

Timeline

3rd July 2025:

Reported the issue to the vendor. The vendor responded on the same day.

4th July 2025:

The vendor raised the issue internally for furthter investigation and confirmation

19th September 2025:

The vendor confirmed the issue, conducted investigation, developed updated firmware, tested the updated firmware and rolled out to the production of the affected handset.