CVE-2014-2560

HIGH

PhonerLite < 2.15 - Password Hash Disclosure via SIP Digest Leak

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-2560. PoCs published by Jason Ostrom.

AI-analyzed exploit summary This advisory describes an information disclosure vulnerability in PhonerLite 2.14, where a spoofed SIP INVITE message can leak MD5 digest credentials via a crafted 401 challenge, allowing offline brute-force attacks.

Description

The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue.

Exploits (1)

exploitdb WRITEUP
by Jason Ostrom · textremotewindows
https://www.exploit-db.com/exploits/32643

This advisory describes an information disclosure vulnerability in PhonerLite 2.14, where a spoofed SIP INVITE message can leak MD5 digest credentials via a crafted 401 challenge, allowing offline brute-force attacks.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: PhonerLite SIP Soft Phone 2.14
No auth needed
Prerequisites: IP address of PhonerLite endpoint listening on TCP port 5060 · SIP protocol tester (e.g., SIPp)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Mailing List, Third Party Advisory x_refsource_misc
https://seclists.org/bugtraq/2014/Mar/185

Scores

CVSS v3 7.5
EPSS 0.0168
EPSS Percentile 73.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-916
Status published
Products (1)
phoner/phonerlite < 2.15
Published Feb 12, 2020
Tracked Since Feb 18, 2026