A vulnerability, which was classified as critical, was found in Pingtel xpressa 1.2.5/1.2.7.4. This affects an unknown function of the component App Installer. The manipulation with an unknown input leads to a authentication spoofing vulnerability. CWE is classifying the issue as CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attackers to install Trojan horse applications via DNS spoofing.

The weakness was disclosed 07/23/2002 by Ofir Arkin (Website). The advisory is shared at pingtel.com. This vulnerability is uniquely identified as CVE-2002-0671. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (9566) and SecurityFocus (BID 5224†). The entries VDB-18414, VDB-18415, VDB-18416 and VDB-18418 are pretty similar.

Productinfo

Vendor

• Pingtel

Name

• xpressa

Version

• 1.2.5
• 1.2.7.4

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion