Cisco 7940/7960 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to verify a subscription, which allows remote attackers to spoof messages such as the "Messages waiting" message.
References
| Link | Resource |
|---|---|
| http://marc.info/?l=bugtraq&m=112067698624686&w=2 | Mailing List |
| http://pentest.tele-consulting.com/advisories/05_07_06_voip-phones.txt | Broken Link Vendor Advisory |
| http://www.securitytracker.com/alerts/2005/Jul/1014406.html | Broken Link Third Party Advisory VDB Entry |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/21260 | Third Party Advisory VDB Entry |
| http://marc.info/?l=bugtraq&m=112067698624686&w=2 | Mailing List |
| http://pentest.tele-consulting.com/advisories/05_07_06_voip-phones.txt | Broken Link Vendor Advisory |
| http://www.securitytracker.com/alerts/2005/Jul/1014406.html | Broken Link Third Party Advisory VDB Entry |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/21260 | Third Party Advisory VDB Entry |
Configurations
History
20 Nov 2024, 23:58
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://marc.info/?l=bugtraq&m=112067698624686&w=2 - Mailing List | |
| References | () http://pentest.tele-consulting.com/advisories/05_07_06_voip-phones.txt - Broken Link, Vendor Advisory | |
| References | () http://www.securitytracker.com/alerts/2005/Jul/1014406.html - Broken Link, Third Party Advisory, VDB Entry | |
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/21260 - Third Party Advisory, VDB Entry |
08 Feb 2024, 20:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/21260 - Third Party Advisory, VDB Entry | |
| References | (MISC) http://pentest.tele-consulting.com/advisories/05_07_06_voip-phones.txt - Broken Link, Vendor Advisory | |
| References | (BUGTRAQ) http://marc.info/?l=bugtraq&m=112067698624686&w=2 - Mailing List | |
| References | (SECTRACK) http://www.securitytracker.com/alerts/2005/Jul/1014406.html - Broken Link, Third Party Advisory, VDB Entry | |
| First Time |
Cisco ip Phone 7940
Cisco ip Phone 7940 Firmware Cisco ip Phone 7960 Cisco ip Phone 7960 Firmware |
|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| CWE | CWE-347 | |
| CPE | cpe:2.3:h:cisco:7960_router:*:*:*:*:*:*:*:* |
cpe:2.3:o:cisco:ip_phone_7940_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_phone_7940:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_phone_7960:-:*:*:*:*:*:*:* cpe:2.3:o:cisco:ip_phone_7960_firmware:-:*:*:*:*:*:*:* |
Information
Published : 2005-07-11 04:00
Updated : 2024-11-20 23:58
NVD link : CVE-2005-2181
Mitre link : CVE-2005-2181
CVE.ORG link : CVE-2005-2181
JSON object : View
Products Affected
cisco
- ip_phone_7940_firmware
- ip_phone_7940
- ip_phone_7960
- ip_phone_7960_firmware
CWE
CWE-347
Improper Verification of Cryptographic Signature