CVE-2007-4459: cisco voip_phone_cp-7940 Improper Input Validation

Vulnerability summary

CVE-2007-4459 is a high (CVSS 7.1) Improper Input Validation vulnerability in cisco voip_phone_cp-7940. EPSS estimates a 13.99% chance of exploitation in the next 30 days, higher than 96.5% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 21-08-2007
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

Cisco IP Phone 7940 and 7960 with P0S3-08-6-00 firmware, and other SIP firmware before 8.7(0), allows remote attackers to cause a denial of service (device reboot) via (1) a certain sequence of 10 invalid SIP INVITE and OPTIONS messages; or (2) a certain invalid SIP INVITE message that contains a remote tag, followed by a certain set of two related SIP OPTIONS messages.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.