Vulnerability Description
The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited time
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Unified Ip Conference Station 7935 Firmware | <= 3.2\(15\) |
| Cisco | Unified Ip Conference Station 7935 | - |
| Cisco | Unified Ip Conference Station Firmware 7936 | <= 3.3\(12\) |
| Cisco | Unified Ip Conference Station 7936 | - |
Related Weaknesses (CWE)
References
- http://osvdb.org/45245Broken Link
- http://secunia.com/advisories/24262Vendor Advisory
- http://securitytracker.com/id?1017680Third Party AdvisoryVDB Entry
- http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtmlVendor Advisory
- http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtmlPatchVendor Advisory
- http://www.securityfocus.com/bid/22647Third Party AdvisoryVDB Entry
- http://www.vupen.com/english/advisories/2007/0688Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32623VDB Entry
- http://osvdb.org/45245Broken Link
- http://secunia.com/advisories/24262Vendor Advisory
- http://securitytracker.com/id?1017680Third Party AdvisoryVDB Entry
- http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtmlVendor Advisory
- http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtmlPatchVendor Advisory
- http://www.securityfocus.com/bid/22647Third Party AdvisoryVDB Entry
- http://www.vupen.com/english/advisories/2007/0688Vendor Advisory
FAQ
What is CVE-2007-1062?
CVE-2007-1062 is a vulnerability with a CVSS score of 10.0 (HIGH). The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass aut...
How severe is CVE-2007-1062?
CVE-2007-1062 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-1062?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Unified Ip Conference Station 7935 Firmware, Cisco Unified Ip Conference Station 7935, Cisco Unified Ip Conference Station Firmware 7936, Cisco Unified Ip Conference Station 7936.