CVE-2007-3347

The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:N/I:C/A:N

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/24560
http://secunia.com/advisories/25803
http://www.vupen.com/english/advisories/2007/2320
https://exchange.xforce.ibmcloud.com/vulnerabilities/35063
http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=219&

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:d-link:dph-541:1.00.03:::::::*
	cpe:2.3:h:d-link:dph-540:1.00.14:::::::*
	cpe:2.3:h:d-link:dph-540:1.00.03:::::::*
	cpe:2.3:h:d-link:dph-541:1.00.14:::::::*

History

07 Nov 2023, 02:00

Type	Values Removed	Values Added
References	{'url': 'http://www.sipera.com/index.php?action=resources,threat_advisory&tid=219&', 'name': 'http://www.sipera.com/index.php?action=resources,threat_advisory&tid=219&', 'tags': ['Patch'], 'refsource': 'MISC'}	() http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=219& -

Information

Published : 2007-06-22 18:30

Updated : 2023-11-07 02:00

NVD link : CVE-2007-3347

Mitre link : CVE-2007-3347

JSON object : View

Products Affected

d-link

dph-540
dph-541

CWE

NVD-CWE-Other

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/24560", "name": "24560", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/25803", "name": "25803", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2007/2320", "name": "ADV-2007-2320", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35063", "name": "dlink-wifi-sipinvite-spoofing(35063)", "tags": [], "refsource": "XF"}, {"url": "http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=219&", "name": "http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=219&", "tags": [], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-3347", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:N", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "HIGH", "impactScore": 6.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2007-06-22T18:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:d-link:dph-541:1.00.03:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:d-link:dph-540:1.00.14:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:d-link:dph-540:1.00.03:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:d-link:dph-541:1.00.14:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-11-07T02:00Z"}