CVE-2005-2181
HIGHCisco IP Phone 7940 and 7960 Firmware - Message Spoofing via Improper Cryptographic Signature Verification
Title source: llmDescription
Cisco 7940/7960 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to verify a subscription, which allows remote attackers to spoof messages such as the "Messages waiting" message.
References (4)
Core 4
Core References
Broken Link, Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/alerts/2005/Jul/1014406.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/21260
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=112067698624686&w=2
Broken Link, Vendor Advisory x_refsource_misc
http://pentest.tele-consulting.com/advisories/05_07_06_voip-phones.txt
Scores
CVSS v3
7.5
EPSS
0.0119
EPSS Percentile
63.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-347
Status
published
Products (2)
cisco/ip_phone_7940_firmware
cisco/ip_phone_7960_firmware
Published
Jul 11, 2005
Tracked Since
Feb 18, 2026