CVEvulnerability

CVE-2007-5361

8.5 HIGH Published 2007-11-20 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2007-11-20
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
8.5 HIGH — AV:N/AC:L/Au:N/C:P/I:N/A:C

Description

The Communication Server in Alcatel-Lucent OmniPCX Enterprise 7.1 and earlier caches an IP address during a TFTP request from an IP Touch phone, and uses this IP address as the destination for all subsequent VoIP packets to this phone, which allows remote attackers to cause a denial of service (loss of audio) or intercept voice communications via a crafted TFTP request containing the phone's MAC address in the filename.

Affected configurations

• alcatel-lucent omnipcx (<= 7.1)

References