Is CVE-2009-1048 being actively exploited?

CVE-2009-1048 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2009-1048?

CVE-2009-1048 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2009-1048

CRITICAL · CVSS 9.8EPSS 6.4%EU EUVD

The web interface on the snom VoIP phones snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 6.5 before 6.5.20, 7.1 before 7.1.39, and 7.3 before 7.3.14 allows remote attackers to bypass authentication, and reconfigure the phone or make arbitrary use of the phone, via a (1) http or (2) https request with 127.0.0.1 in the Host header.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-290
EPSS score: 6.4% (94th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2009-1049)
Published: August 14, 2009
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2009-1049 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

snom / snom 300
snom / snom 300 firmware
snom / snom 320
snom / snom 320 firmware
snom / snom 360
snom / snom 360 firmware
snom / snom 370
snom / snom 370 firmware
snom / snom 820
snom / snom 820 firmware

References

http://secunia.com/advisories/36293(Broken Link, Vendor Advisory)
http://www.csnc.ch/misc/files/advisories/cve-2009-1048.txt(Broken Link)
http://www.securityfocus.com/archive/1/505723/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
https://exchange.xforce.ibmcloud.com/vulnerabilities/52424(Third Party Advisory, VDB Entry)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain