CVE-2007-3319 json
The Avaya 4602SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware does not use the cnonce parameter in the Authorization heade…
published 2007-06-21 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-3309
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
The Avaya 4602SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware does not use the cnonce parameter in the Authorization header of SIP requests during MD5 digest authentication, which allows remote attackers to conduct man-in-the-middle attacks and hijack or intercept communications.
Exploit prediction
1.63% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
support.avaya.com
/elmodocs2/security/ASA-2007-263.htm
vendor-advisory
-
secunia.com
/advisories/25747
third-party-advisory, vendor-advisory
- sipera.com /index.php?action=resources%2Cthreat_advisory&tid=299&
-
osvdb.org
/38115
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/34972
vdb-entry
-
securityfocus.com
/bid/24539
vdb-entry
Sources
- CVE List CVE-2007-3319
- NVD CVE-2007-3319
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.