CVE-2007-3347

The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:N/I:C/A:N

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact NONE

References

Link	Resource
http://www.sipera.com/index.php?action=resources,threat_advisory&tid=219&	Patch
http://www.securityfocus.com/bid/24560
http://secunia.com/advisories/25803
http://www.vupen.com/english/advisories/2007/2320
https://exchange.xforce.ibmcloud.com/vulnerabilities/35063

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:d-link:dph-541:1.00.03:::::::*
	cpe:2.3:h:d-link:dph-541:1.00.14:::::::*
	cpe:2.3:h:d-link:dph-540:1.00.03:::::::*
	cpe:2.3:h:d-link:dph-540:1.00.14:::::::*

Information

Published : 2007-06-22 11:30

Updated : 2017-07-28 18:32

NVD link : CVE-2007-3347

Mitre link : CVE-2007-3347

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

d-link

dph-540
dph-541

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.sipera.com/index.php?action=resources,threat_advisory&tid=219&", "name": "http://www.sipera.com/index.php?action=resources,threat_advisory&tid=219&", "tags": ["Patch"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/24560", "name": "24560", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/25803", "name": "25803", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2007/2320", "name": "ADV-2007-2320", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35063", "name": "dlink-wifi-sipinvite-spoofing(35063)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-3347", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:N", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "HIGH", "impactScore": 6.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2007-06-22T18:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:d-link:dph-541:1.00.03:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:d-link:dph-541:1.00.14:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:d-link:dph-540:1.00.03:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:d-link:dph-540:1.00.14:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-29T01:32Z"}