Unscored severity · published Jun 21, 2007
CVE-2007-3319
The Avaya 4602SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware does not use the cnonce parameter in the Authorization header of SIP requests during MD5 digest…
–
CVSS
1.6%
EPSS
No
On KEV
Description
The Avaya 4602SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware does not use the cnonce parameter in the Authorization header of SIP requests during MD5 digest authentication, which allows remote attackers to conduct man-in-the-middle attacks and hijack or intercept communications.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
4I
4602sw IP Phone · Avaya
r2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-3319
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-3319
osvdb.org
http://osvdb.org/38115
Vendor Advisory
http://secunia.com/advisories/25747
Vendor Advisory
http://support.avaya.com/elmodocs2/security/ASA-2007-263.htm
www.securityfocus.com
http://www.securityfocus.com/bid/24539
www.sipera.com
http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=299&
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/34972
More from 4602sw IP Phone
–
CVE-2007-3320
The Avaya 4602SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware accepts SIP INVITE requests from arbitrary source IP addresses, which allows remote attackers to…
–
CVE-2007-3321
The Avaya 4602 SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware allows remote attackers to cause a denial of service (device reboot) via a flood of packets to the…
–
CVE-2007-3322
The Avaya 4602 SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware uses a constant media port number for calls, which allows remote attackers to cause a denial of…