vulnwire
4.3med

CVE-2007-5638

The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BC…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 74%
Public exploits
0
none known

The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines, use only 65536 different values in the 32-bit ID number field of an RUDP datagram, which makes it easier for remote attackers to guess the RUDP ID and spoof messages. NOTE: this can be leveraged for an eavesdropping attack by sending many Open Audio Stream messages.

Exploit prediction (EPSS)

1.47% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-310 Cryptographic Issues

References

  • exchange.xforce.ibmcloud.com /vulnerabilities/37255 · vdb-entry, x_refsource_XF, x_transferred
  • secunia.com /advisories/27234 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • osvdb.org /41770 · vdb-entry, x_refsource_OSVDB, x_transferred
  • csnc.ch /static/advisory/csnc/nortel_IP_phone_surveillance_mode_v1.0.txt · x_refsource_MISC, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/42881 · vdb-entry, x_refsource_XF, x_transferred
  • securityreason.com /securityalert/3272 · third-party-advisory, x_refsource_SREASON, x_transferred
  • securityfocus.com /archive/1/482478/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /bid/26120 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.