CVE-2009-1048
Critical
Description
The web interface on the snom VoIP phones snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 6.5 before 6.5.20, 7.1 before 7.1.39, and 7.3 before 7.3.14 allows remote attackers to bypass authentication, and reconfigure the phone or make arbitrary use of the phone, via a (1) http or (2) https request with 127.0.0.1 in the Host header.
SeverityCritical
CVSS9.8
Exploit probability—
ProductSnom 300 Firmware
PublishedAug 14, 2009
First seenAug 14, 2009
How to fix
Update
- snom snom_300_firmware6.5.20, 7.1.39, 7.3.14 or later
- snom snom_320_firmware6.5.20, 7.1.39, 7.3.14 or later
- snom snom_360_firmware6.5.20, 7.1.39, 7.3.14 or later
- snom snom_370_firmware6.5.20, 7.1.39, 7.3.14 or later
- snom snom_820_firmware6.5.20, 7.1.39, 7.3.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| snom snom_300_firmware | 6.5 ≤ v < 6.5.20, 7.1 ≤ v < 7.1.39, 7.3 ≤ v < 7.3.14 | 6.5.20, 7.1.39, 7.3.14 |
| snom snom_320_firmware | 6.5 ≤ v < 6.5.20, 7.1 ≤ v < 7.1.39, 7.3 ≤ v < 7.3.14 | 6.5.20, 7.1.39, 7.3.14 |
| snom snom_360_firmware | 6.5 ≤ v < 6.5.20, 7.1 ≤ v < 7.1.39, 7.3 ≤ v < 7.3.14 | 6.5.20, 7.1.39, 7.3.14 |
| snom snom_370_firmware | 6.5 ≤ v < 6.5.20, 7.1 ≤ v < 7.1.39, 7.3 ≤ v < 7.3.14 | 6.5.20, 7.1.39, 7.3.14 |
| snom snom_820_firmware | 6.5 ≤ v < 6.5.20, 7.1 ≤ v < 7.1.39, 7.3 ≤ v < 7.3.14 | 6.5.20, 7.1.39, 7.3.14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.