CVEvulnerability

CVE-2009-1048

9.8 CRITICAL Published 2009-08-14 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-08-14
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-290

Description

The web interface on the snom VoIP phones snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 6.5 before 6.5.20, 7.1 before 7.1.39, and 7.3 before 7.3.14 allows remote attackers to bypass authentication, and reconfigure the phone or make arbitrary use of the phone, via a (1) http or (2) https request with 127.0.0.1 in the Host header.

Affected configurations

• snom snom 300 firmware (>= 6.5 < 6.5.20) • snom snom 300 firmware (>= 7.1 < 7.1.39) • snom snom 300 firmware (>= 7.3 < 7.3.14) • snom snom 320 firmware (>= 6.5 < 6.5.20) • snom snom 320 firmware (>= 7.1 < 7.1.39) • snom snom 320 firmware (>= 7.3 < 7.3.14) • snom snom 360 firmware (>= 6.5 < 6.5.20) • snom snom 360 firmware (>= 7.1 < 7.1.39) • snom snom 360 firmware (>= 7.3 < 7.3.14) • snom snom 370 firmware (>= 6.5 < 6.5.20) • snom snom 370 firmware (>= 7.1 < 7.1.39) • snom snom 370 firmware (>= 7.3 < 7.3.14) • snom snom 820 firmware (>= 6.5 < 6.5.20) • snom snom 820 firmware (>= 7.1 < 7.1.39) • snom snom 820 firmware (>= 7.3 < 7.3.14)

Related

Weakness · CWE (1)

  • CWE-290 Authentication Bypass by Spoofing weakness

Referenced by CWE · observed example (2)

  • CWE-287 Improper Authentication weakness
  • CWE-290 Authentication Bypass by Spoofing weakness

References