Back to CVE Browser

CVE-2007-5361

HIGH

8.5

CVSS Severity Score

EPSS Score0.1920%

EPSS Percentile26.17th

PublishedNov 20, 2007

Last ModifiedApr 23, 2026

Vulnerability Description

The Communication Server in Alcatel-Lucent OmniPCX Enterprise 7.1 and earlier caches an IP address during a TFTP request from an IP Touch phone, and uses this IP address as the destination for all subsequent VoIP packets to this phone, which allows remote attackers to cause a denial of service (loss of audio) or intercept voice communications via a crafted TFTP request containing the phone's MAC address in the filename.

Affected Platforms (CPE)

📦

Alcatel Lucent

Omnipcx

<= 7.1

References & Advisories

🔗 http://osvdb.org/40522

🔗 http://secunia.com/advisories/27710

🔗 http://securityreason.com/securityalert/3387

🔗 http://www.csnc.ch/static/advisory/csnc/alcatel_omnipcx_enterprise_audio_rerouting_vulnerability_v1.0.txt

🔗 http://www.securityfocus.com/archive/1/483925/100/0/threaded

🔗 http://www.securityfocus.com/bid/26494

🔗 http://www.securitytracker.com/id?1018983

🔗 http://www.vupen.com/english/advisories/2007/3919

Related Vulnerabilities

CVE-2002-169110.0

Alcatel OmniPCX 4400 installs known user accounts and passwords in the /etc/password file by default, which allows remote attacker...

CVE-2008-133110.0

cgi-data/FastJSData.cgi in OmniPCX Office with Internet Access services OXO210 before 210/091.001, OXO600 before 610/014.001, and ...

CVE-2007-30109.8

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attack...

CVE-2007-25127.5

Alcatel-Lucent IP-Touch Telephone running OmniPCX Enterprise 7.0 and later enables the mini switch by default, which allows attack...