CVE-2007-1062
First published: Thu Feb 22 2007(Updated: )
The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited time
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified IP Conference Phone 8831 | <=3.2\(15\) | |
| Cisco Unified IP Conference Station 7935 | ||
| Cisco Unified IP Conference Station 7936 | <=3.3\(12\) | |
| Cisco Unified IP Conference Station 7936 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml
- http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtml
- http://www.securityfocus.com/bid/22647
- http://securitytracker.com/id?1017680
- http://secunia.com/advisories/24262
- http://osvdb.org/45245
- http://www.vupen.com/english/advisories/2007/0688
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32623
Frequently Asked Questions
What is the severity of CVE-2007-1062?
CVE-2007-1062 is classified as a medium severity vulnerability.
How do I fix CVE-2007-1062?
To fix CVE-2007-1062, upgrade to a firmware version later than 3.2(15) for the 7935 model and later than 3.3(12) for the 7936 model.
What systems are affected by CVE-2007-1062?
CVE-2007-1062 affects Cisco Unified IP Conference Stations 7935 with firmware versions up to 3.2(15) and 7936 with firmware versions up to 3.3(12).
What is the nature of the vulnerability in CVE-2007-1062?
CVE-2007-1062 allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface.
Is there any workaround for CVE-2007-1062?
Currently, the recommended course of action for CVE-2007-1062 is to upgrade the affected devices, as there are no effective workarounds to mitigate the issue.
- collector/nvd-historical
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco unified ip conference phone 8831
- version/cisco unified ip conference phone 8831/3.2\(15\)
- canonical/cisco unified ip conference station 7935
- canonical/cisco unified ip conference station 7936
- version/cisco unified ip conference station 7936/3.3\(12\)