Executive Summary
Informations | |||
---|---|---|---|
Name | CVE-2009-1048 | First vendor Publication | 2009-08-14 |
Vendor | Cve | Last vendor Modification | 2024-02-13 |
Security-Database Scoring CVSS v3
Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | |||
---|---|---|---|
Overall CVSS Score | 9.8 | ||
Base Score | 9.8 | Environmental Score | 9.8 |
impact SubScore | 5.9 | Temporal Score | 9.8 |
Exploitabality Sub Score | 3.9 | ||
Attack Vector | Network | Attack Complexity | Low |
Privileges Required | None | User Interaction | None |
Scope | Unchanged | Confidentiality Impact | High |
Integrity Impact | High | Availability Impact | High |
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 10 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
The web interface on the snom VoIP phones snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 6.5 before 6.5.20, 7.1 before 7.1.39, and 7.3 before 7.3.14 allows remote attackers to bypass authentication, and reconfigure the phone or make arbitrary use of the phone, via a (1) http or (2) https request with 127.0.0.1 in the Host header. |
Original Source
Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1048 |
CAPEC : Common Attack Pattern Enumeration & Classification
Id | Name |
---|---|
CAPEC-22 | Exploiting Trust in Client (aka Make the Client Invisible) |
CAPEC-57 | Utilizing REST's Trust in the System Resource to Register Man in the Middle |
CAPEC-89 | Pharming |
CAPEC-94 | Man in the Middle Attack |
CAPEC-114 | Authentication Abuse |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-290 | Authentication Bypass by Spoofing |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Os | 1 | |
Os | 1 | |
Os | 1 | |
Os | 1 | |
Os | 1 |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
57028 | Snom VoIP Phones Crafted Host Header Authentication Bypass Snom VoIP Phones contains a flaw that may allow a malicious user to bypass authentication. The issue is triggered when a malicious user submits a crafted HTTP request with the Host header set to "127.0.0.1. It is possible that the flaw may allow administrative access resulting in a loss of integrity. |
Sources (Detail)
Alert History
Date | Informations |
---|---|
2024-02-13 21:27:55 |
|
2021-05-04 12:09:18 |
|
2021-04-22 01:09:39 |
|
2020-05-23 00:23:32 |
|
2018-10-11 00:19:33 |
|
2017-08-17 09:22:31 |
|
2016-04-26 18:43:09 |
|
2013-05-10 23:47:16 |
|