« Volver al listado

CVE-2007-1590

Estado: ModificadaAlta (7.8)—💥 Exploit

El teléfono IP Grandstream BudgeTone 200, con el programa 1.1.1.14 y el cargador de arranque 1.1.1.5, permite a atacantes remotos provocar una denegación de servicio (caída del dispositivo) mediante mensajes SIP (1) INVITE, (2) CANCEL, y otros no especificados con una cabecera WWW-Authenticate que contiene un dominio Digest manipulado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Grandstream — Budgetone 200

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-1590",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-03-21T23:19:00.000",
  "references": [
    {
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/053099.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/34347",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/24538",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/23075",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1017804",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/1054",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33108",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/053099.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/34347",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/24538",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/23075",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1017804",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/1054",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33108",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Grandstream BudgeTone 200 IP phone, with program 1.1.1.14 and bootloader 1.1.1.5, allows remote attackers to cause a denial of service (device crash) via SIP (1) INVITE, (2) CANCEL, or unspecified other messages with a WWW-Authenticate header containing a crafted Digest domain."
    },
    {
      "lang": "es",
      "value": "El teléfono IP Grandstream BudgeTone 200, con el programa 1.1.1.14 y el cargador de arranque 1.1.1.5, permite a atacantes remotos provocar una denegación de servicio (caída del dispositivo) mediante mensajes SIP (1) INVITE, (2) CANCEL, y otros no especificados con una cabecera WWW-Authenticate que contiene un dominio Digest manipulado."
    }
  ],
  "lastModified": "2026-06-16T22:37:53.550",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:grandstream:budgetone_200:1.1.1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94D18154-5192-46A8-92BB-0006B679F7FE"
            },
            {
              "criteria": "cpe:2.3:h:grandstream:budgetone_200:1.1.1.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FFD9FA4-74DF-40A1-BD2F-F2470663BD3F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}