VulnerabilityModified

CVE-2007-1062

The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the…

HIGH 10.0EPSS 4.17%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (4.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS: 4.17% probability · 90th percentile
CISA KEV: Not listed
Weakness: CWE-287
Affected: cisco/unified ip conference station 7935 firmware · cisco/unified ip conference station firmware 7936
Source: cve@mitre.org

References

http://osvdb.org/45245Broken Link
http://secunia.com/advisories/24262Vendor Advisory
http://securitytracker.com/id?1017680Third Party Advisory, VDB Entry
http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtmlVendor Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/22647Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2007/0688Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/32623VDB Entry
http://osvdb.org/45245Broken Link
http://secunia.com/advisories/24262Vendor Advisory
http://securitytracker.com/id?1017680Third Party Advisory, VDB Entry
http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtmlVendor Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/22647Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2007/0688Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/32623VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.