CVE-2007-0528
The admin web console implemented by the Centrality Communications (aka Aredfox) PA168 chipset and firmware 1.54 and earlier, as provided by various IP phones, does not require passwords or authentication tokens when using HTTP, which allows remote…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The admin web console implemented by the Centrality Communications (aka Aredfox) PA168 chipset and firmware 1.54 and earlier, as provided by various IP phones, does not require passwords or authentication tokens when using HTTP, which allows remote attackers to connect to existing superuser sessions and obtain sensitive information (passwords and configuration data).
- CVSS 2.0
- 9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C
- EPSS
- 4.49% probability · 91th percentile
- CISA KEV
- Not listed
- Affected
- centrality communications/pa168 chipset
- Source
- cve@mitre.org
References
- http://osvdb.org/32966
- http://secunia.com/advisories/23919
- http://secunia.com/advisories/23936
- http://www.procheckup.com/Vulner_PR0614.phpVendor Advisory
- http://www.securityfocus.com/archive/1/457868/100/0/threaded
- http://www.vupen.com/english/advisories/2007/0346
- https://www.exploit-db.com/exploits/3189
- http://osvdb.org/32966
- http://secunia.com/advisories/23919
- http://secunia.com/advisories/23936
- http://www.procheckup.com/Vulner_PR0614.phpVendor Advisory
- http://www.securityfocus.com/archive/1/457868/100/0/threaded
- http://www.vupen.com/english/advisories/2007/0346
- https://www.exploit-db.com/exploits/3189
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.