PT-2002-1700 · Pingtel · Pingtel Xpressa

Published 2002-07-23 · Updated 2017-10-10 · CVE-2002-0674

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pingtel xpressa SIP-based voice-over-IP phone versions 1.2.5 through 1.2.7.4

Description The issue allows other users to perform administrator actions if the administrator does not explicitly end the authentication, due to the failure to "time out" an inactive administrator session.

Recommendations For versions 1.2.5 through 1.2.7.4, consider implementing a session timeout mechanism to automatically end inactive administrator sessions, or ensure that administrators explicitly log out when their session is inactive to prevent unauthorized access.

Fix

Related Identifiers

CVE-2002-0674

Affected Products

Pingtel Xpressa

References · 5

• http://atstake.com/research/advisories/2002/a071202-1.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0674 · Security Note
• http://pingtel.com/PingtelAtStakeAdvisoryResponse.jsp · Note
• http://securityfocus.com/bid/5221 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/9569 · Note