Unscored severity · published Oct 16, 2007
CVE-2007-5468
Cisco CallManager 5.1.1.3000-5 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Cisco CallManager 5.1.1.3000-5 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID (aka "toll fraud and authentication forward attack").
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Call Manager · Cisco
5.1.1.3000 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-5468
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-5468
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066581.html
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066691.html
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066694.html
secunia.com
http://secunia.com/advisories/27231
www.securityfocus.com
http://www.securityfocus.com/bid/26057
www.vupen.com
http://www.vupen.com/english/advisories/2007/3534
More from Call Manager
7.5
CVE-2004-0079
The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake…
–
CVE-2007-4634
Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before…
–
CVE-2007-4633
Multiple cross-site scripting (XSS) vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2,…
–
CVE-2007-2832
Cross-site scripting (XSS) vulnerability in the web application firewall in Cisco CallManager before 3.3(5)sr3, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before…
–
CVE-2007-1467
Multiple cross-site scripting (XSS) vulnerabilities in (1) PreSearch.html and (2) PreSearch.class in Cisco Secure Access Control Server (ACS), VPN Client, Unified Personal…