CVEvulnerability
CVE-2007-0528
9.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-01-26
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
Description
The admin web console implemented by the Centrality Communications (aka Aredfox) PA168 chipset and firmware 1.54 and earlier, as provided by various IP phones, does not require passwords or authentication tokens when using HTTP, which allows remote attackers to connect to existing superuser sessions and obtain sensitive information (passwords and configuration data).
Affected configurations
• centrality communications pa168 chipset (<= firmware 1.54)
References
- http://osvdb.org/32966 osvdb.org
- http://secunia.com/advisories/23919 secunia.com
- http://secunia.com/advisories/23936 secunia.com
- http://www.procheckup.com/Vulner_PR0614.php Vendor Advisory
- http://www.securityfocus.com/archive/1/457868/100/0/threaded www.securityfocus.com
- http://www.vupen.com/english/advisories/2007/0346 www.vupen.com
- https://www.exploit-db.com/exploits/3189 www.exploit-db.com
- http://osvdb.org/32966 osvdb.org
- http://secunia.com/advisories/23919 secunia.com
- http://secunia.com/advisories/23936 secunia.com
- http://www.procheckup.com/Vulner_PR0614.php Vendor Advisory
- http://www.securityfocus.com/archive/1/457868/100/0/threaded www.securityfocus.com
- http://www.vupen.com/english/advisories/2007/0346 www.vupen.com
- https://www.exploit-db.com/exploits/3189 www.exploit-db.com