CVE-2009-1048

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

The web interface on the snom VoIP phones snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 6.5 before 6.5.20, 7.1 before 7.1.39, and 7.3 before 7.3.14 allows remote attackers to bypass authentication, and reconfigure the phone or make arbitrary use of the phone, via a (1) http or (2) https request with 127.0.0.1 in the Host header.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published: Aug 14, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-10497.5SQL injection vulnerability in articleCall.php in Bloginator 1A allows remote attackers to execute arbitrary SQL commands via the id paramet CVE-2009-10507.5Bloginator 1A allows remote attackers to bypass authentication and gain administrative access by setting the identifyYourself cookie.CVE-2009-10515.0FubarForum 1.6 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers t CVE-2009-10525.0FireAnt 1.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to d CVE-2009-10535.0chaozzDB 1.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to CVE-2009-10549.3Unspecified vulnerability in JustSystems Ichitaro 13, 2004 through 2008, Lite2, and Ichitaro viewer 5.1.5.0 and earlier allows remote attack CVE-2009-10554.0Unspecified vulnerability in the web service in Sitecore CMS 5.3.1 rev. 071114 allows remote authenticated users to gain access to security CVE-2009-10565.0IBM Rational AppScan Enterprise before 5.5 FP1 allows remote attackers to read arbitrary exported reports by "forcefully browsing."CVE-2009-105710.0MicroSmarts Enterprise ZipItFast! 3.0 allows remote attackers to execute arbitrary code via a crafted .zip file that triggers memory corrupt CVE-2009-105810.0Stack-based buffer overflow in ZipGenius might allow remote attackers to execute arbitrary code via a crafted .zip file that triggers an SEH CVE-2009-10599.3Stack-based buffer overflow in Trident PowerZip 7.2 might allow remote attackers to execute arbitrary code via a crafted .zip file. NOTE: C CVE-2009-10609.3Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered