« Back to list

CVE-2007-3286

Status: ModifiedMedium (6.8)—

Multiple buffer overflows in unspecified ActiveX controls in COM objects in Avaya IP Softphone R5.2 before SP3, and R6.0, allow remote attackers to execute arbitrary code via unspecified vectors.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Avaya — IP Soft Phone

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2007-3286",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-09-19T18:17:00.000",
  "references": [
    {
      "url": "http://osvdb.org/38258",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-314.htm",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/25707",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/38258",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-314.htm",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/25707",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple buffer overflows in unspecified ActiveX controls in COM objects in Avaya IP Softphone R5.2 before SP3, and R6.0, allow remote attackers to execute arbitrary code via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Múltiples desbordamientos de búfer en controles ActiveX en objetos COM de Avaya IP Softphone R5.2 anterior a SP3, y R6.0, permite a atacantes remotos ejecutar código de su elección mediante vectores no especificados."
    }
  ],
  "lastModified": "2026-06-16T22:41:25.423",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:avaya:ip_soft_phone:*:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "053EAEA7-D936-46E8-B8DA-AC9B484ED57C",
              "versionEndIncluding": "5.2"
            },
            {
              "criteria": "cpe:2.3:a:avaya:ip_soft_phone:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85F6B57D-1319-4A71-9A4A-6A2D01DA4F5D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}