PT-2009-3629 · Snom · Snom 820+4

CVE-2009-1048

·

Publicado

2009-08-14

·

Atualizado

2024-02-13

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions snom 300 versions 6.5 through 6.5.19 snom 300 versions 7.1 through 7.1.38 snom 300 versions 7.3 through 7.3.13 snom 320 versions 6.5 through 6.5.19 snom 320 versions 7.1 through 7.1.38 snom 320 versions 7.3 through 7.3.13 snom 360 versions 6.5 through 6.5.19 snom 360 versions 7.1 through 7.1.38 snom 360 versions 7.3 through 7.3.13 snom 370 versions 6.5 through 6.5.19 snom 370 versions 7.1 through 7.1.38 snom 370 versions 7.3 through 7.3.13 snom 820 versions 6.5 through 6.5.19 snom 820 versions 7.1 through 7.1.38 snom 820 versions 7.3 through 7.3.13
Description The web interface of the snom VoIP phones allows remote attackers to bypass authentication and reconfigure the phone or make arbitrary use of the phone. This can be achieved via an http or https request with 127.0.0.1 in the Host header.
Recommendations For snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 6.5, update to version 6.5.20 or later. For snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 7.1, update to version 7.1.39 or later. For snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 7.3, update to version 7.3.14 or later.

Correção

Authentication Bypass by Spoofing

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2009-1048

Produtos afetados

Snom 300
Snom 320
Snom 360
Snom 370
Snom 820