Description
The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited time
References (8)
Core 8
Core References
Vendor Advisory vendor-advisory
x_refsource_cisco
http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtml
Patch, Vendor Advisory vendor-advisory
x_refsource_cisco
http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24262
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1017680
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/22647
Broken Link vdb-entry
x_refsource_osvdb
http://osvdb.org/45245
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2007/0688
VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/32623
Scores
EPSS
0.0417
EPSS Percentile
89.6%
Details
CWE
CWE-287
Status
published
Products (2)
cisco/unified_ip_conference_station_7935_firmware
< 3.2\(15\)
cisco/unified_ip_conference_station_firmware_7936
< 3.3\(12\)
Published
Feb 22, 2007
Tracked Since
Feb 18, 2026