CVE-2007-3319
HIGH · CVSS 7.5EPSS 1.6%EU EUVD
The Avaya 4602SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware does not use the cnonce parameter in the Authorization header of SIP requests during MD5 digest authentication, which allows remote attackers to conduct man-in-the-middle attacks and hijack or intercept communications.
Key facts
- CVSS score
- 7.5 (v2.0)
- Severity
- HIGH
- CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P- EPSS score
- 1.6% (76th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2007-3309)
- Published
- June 21, 2007
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2007-3309 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- avaya / 4602sw ip phone
References
- http://osvdb.org/38115
- http://secunia.com/advisories/25747(Vendor Advisory)
- http://support.avaya.com/elmodocs2/security/ASA-2007-263.htm(Vendor Advisory)
- http://www.securityfocus.com/bid/24539
- http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=299&
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34972
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain