NVD Vulnerability Detail

CVE-2007-1063

Summary	The SSH server in Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G, and 7971G, with firmware 8.0(4)SR1 and earlier, uses a hard-coded username and password, which allows remote attackers to access the device.
Publication Date	Feb. 22, 2007, 10:28 a.m.
Registration Date	Jan. 29, 2021, 2:07 p.m.
Last Update	May 24, 2019, 1:15 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:cisco:unified_ip_phone_firmware_7906g:8.0\(4\):sr1::::::
execution environment
1	cpe:2.3:h:cisco:unified_ip_phone_7906g:-:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:cisco:unified_ip_phone_firmware_7911g:8.0\(4\):sr1::::::
execution environment
1	cpe:2.3:h:cisco:unified_ip_phone_7911g:-:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:cisco:unified_ip_phone_firmware_7941g:8.0\(4\):sr1::::::
execution environment
1	cpe:2.3:h:cisco:unified_ip_phone_7941g:-:::::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:cisco:unified_ip_phone_firmware_7961g:8.0\(4\):sr1::::::
execution environment
1	cpe:2.3:h:cisco:unified_ip_phone_7961g:-:::::::*

Configuration5		or higher	or less	more than	less than
cpe:2.3:o:cisco:unified_ip_phone_firmware_7970g:8.0\(4\):sr1::::::
execution environment
1	cpe:2.3:h:cisco:unified_ip_phone_7970g:-:::::::*

Configuration6		or higher	or less	more than	less than
cpe:2.3:o:cisco:unified_ip_phone_firmware_7971g:8.0\(4\):sr1::::::
execution environment
1	cpe:2.3:h:cisco:unified_ip_phone_7971g:-:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://osvdb.org/45246	OSVDB	Broken Link
2	http://secunia.com/advisories/24262	SECUNIA	Vendor Advisory
3	http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtml	CISCO	Vendor Advisory
4	http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml	CISCO	Patch Vendor Advisory
5	http://www.securityfocus.com/bid/22647	BID	Third Party Advisory VDB Entry
6	http://www.securitytracker.com/id?1017681	SECTRACK	Third Party Advisory VDB Entry
7	http://www.vupen.com/english/advisories/2007/0689	VUPEN	Third Party Advisory
8	https://exchange.xforce.ibmcloud.com/vulnerabilities/32627	XF	Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-798	ハードコードされた認証情報の使用	https://cwe.mitre.org/data/definitions/798.html

JVN Vulnerability Information

SSH server in Cisco Unified IP Phone におけるデバイスへアクセスされる脆弱性

Title	SSH server in Cisco Unified IP Phone におけるデバイスへアクセスされる脆弱性
Summary	SSH server in Cisco Unified IP Phone 7906G、7911G、7941G、7961G、7970G、および 7971G には、ハードコーディングされたユーザ名とパスワードを使用するため、デバイスへアクセスされる脆弱性が存在します。
Possible impacts	第三者により、デバイスへアクセスされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 21, 2007, midnight
Registration Date	June 26, 2012, 3:46 p.m.
Last Update	June 26, 2012, 3:46 p.m.

Affected System

シスコシステムズ

Cisco Unified IP Phone 7911G firmware 8.0(4)SR1 およびそれ以前

Cisco Unified IP Phone 7941G firmware 8.0(4)SR1 およびそれ以前

Cisco Unified IP Phone 7961G firmware 8.0(4)SR1 およびそれ以前

Cisco Unified IP Phone 7970G firmware 8.0(4)SR1 およびそれ以前

unified ip phone 7906g firmware 8.0(4)SR1 およびそれ以前

unified ip phone 7971g firmware 8.0(4)SR1 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2007-1063	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1063
National Vulnerability Database (NVD)
2	CVE-2007-1063	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1063

ベンダー情報

No	Name	URL
Cisco
1	cisco-sa-20070221-phone	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone

Change Log

No	Changed Details	Date of change
0	[2012年06月26日] 掲載	Feb. 17, 2018, 10:37 a.m.