CVE-2009-5140

Опубликовано: 12 фев. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 4.3

EPSS Низкий

Описание

The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue.

Ссылки

http://voipsa.org/pipermail/voipsec_voipsa.org/2009-April/002946.html
Mailing List
Third Party Advisory
https://resources.enablesecurity.com/resources/sipdigestleak-tut.pdf
Mailing List
Third Party Advisory
http://voipsa.org/pipermail/voipsec_voipsa.org/2009-April/002946.html
Mailing List
Third Party Advisory
https://resources.enablesecurity.com/resources/sipdigestleak-tut.pdf
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:linksys:spa2102_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:linksys:spa2102:-:*:*:*:*:*:*:*

EPSS

Процентиль: 65%

0.00481

Низкий

8.8 High

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-307

Связанные уязвимости

GHSA-fv24-mphj-4hr6

github

почти 4 года назад