VAR-200710-0057
Vulnerability from variot - Updated: 2025-04-10 23:11Cross-site scripting (XSS) vulnerability in the Linksys SPA941 VoIP Phone with firmware 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the From header in a SIP message. Linksys SPA941 devices are prone to an HTML-injection vulnerability because the built-in webserver fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible. Linksys SPA941 devices with firmware version 5.1.8 are vulnerable; other versions may also be affected.
Try a new way to discover vulnerabilities that ALREADY EXIST in your IT infrastructure.
The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT vulnerabilities in more than 4,700 different Windows applications.
Request your account, the Secunia Network Software Inspector (NSI): http://secunia.com/network_software_inspector/
TITLE: Linksys SPA941 Script Insertion Vulnerability
SECUNIA ADVISORY ID: SA27116
VERIFY ADVISORY: http://secunia.com/advisories/27116/
CRITICAL: Moderately critical
IMPACT: Cross Site Scripting
WHERE:
From remote
OPERATING SYSTEM: Linksys SPA941 VoIP Phone http://secunia.com/product/14032/
DESCRIPTION: Radu State has reported a vulnerability in Linksys SPA941, which can be exploited by malicious people to conduct script insertion attacks.
Input passed via the "From" field in a SIP message is not properly sanitised before being displayed in the integrated web interface of the device.
SOLUTION: Do not use the call history in the integrated web interface.
PROVIDED AND/OR DISCOVERED BY: Radu State
ORIGINAL ADVISORY: http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066430.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200710-0057",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "spa941",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "*"
},
{
"model": "spa941",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "5.1.8"
},
{
"model": "spa941",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "5.1.8_firmware"
},
{
"model": "spa941 voip phone",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "5.1.8"
},
{
"model": "spa941 voip phone",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "0"
}
],
"sources": [
{
"db": "BID",
"id": "25987"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-004506"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-250"
},
{
"db": "NVD",
"id": "CVE-2007-5411"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:linksys:spa941",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-004506"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Radu State",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200710-250"
}
],
"trust": 0.6
},
"cve": "CVE-2007-5411",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2007-5411",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-28773",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2007-5411",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2007-5411",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200710-250",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-28773",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28773"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-004506"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-250"
},
{
"db": "NVD",
"id": "CVE-2007-5411"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in the Linksys SPA941 VoIP Phone with firmware 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the From header in a SIP message. Linksys SPA941 devices are prone to an HTML-injection vulnerability because the built-in webserver fails to properly sanitize user-supplied input before using it in dynamically generated content. \nAttacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible. \nLinksys SPA941 devices with firmware version 5.1.8 are vulnerable; other versions may also be affected. \n\n----------------------------------------------------------------------\n\nTry a new way to discover vulnerabilities that ALREADY EXIST in your\nIT infrastructure. \n\nThe Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT\nvulnerabilities in more than 4,700 different Windows applications. \n\nRequest your account, the Secunia Network Software Inspector (NSI):\nhttp://secunia.com/network_software_inspector/\n\n----------------------------------------------------------------------\n\nTITLE:\nLinksys SPA941 Script Insertion Vulnerability\n\nSECUNIA ADVISORY ID:\nSA27116\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/27116/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nCross Site Scripting\n\nWHERE:\n\u003eFrom remote\n\nOPERATING SYSTEM:\nLinksys SPA941 VoIP Phone\nhttp://secunia.com/product/14032/\n\nDESCRIPTION:\nRadu State has reported a vulnerability in Linksys SPA941, which can\nbe exploited by malicious people to conduct script insertion\nattacks. \n\nInput passed via the \"From\" field in a SIP message is not properly\nsanitised before being displayed in the integrated web interface of\nthe device. \n\nSOLUTION:\nDo not use the call history in the integrated web interface. \n\nPROVIDED AND/OR DISCOVERED BY:\nRadu State\n\nORIGINAL ADVISORY:\nhttp://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066430.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-5411"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-004506"
},
{
"db": "BID",
"id": "25987"
},
{
"db": "VULHUB",
"id": "VHN-28773"
},
{
"db": "PACKETSTORM",
"id": "60069"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-28773",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28773"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-5411",
"trust": 2.8
},
{
"db": "BID",
"id": "25987",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "27116",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2007-004506",
"trust": 0.8
},
{
"db": "XF",
"id": "37022",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20071009 OWNING THE INTERNAL NETWORK WITH SIP (PART 1) AND A LINKSYS PHONE",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200710-250",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "30650",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-28773",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "60069",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28773"
},
{
"db": "BID",
"id": "25987"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-004506"
},
{
"db": "PACKETSTORM",
"id": "60069"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-250"
},
{
"db": "NVD",
"id": "CVE-2007-5411"
}
]
},
"id": "VAR-200710-0057",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-28773"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-10T23:11:34.652000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Linksys",
"trust": 0.8,
"url": "http://home.cisco.com/en-apac/home"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-004506"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28773"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-004506"
},
{
"db": "NVD",
"id": "CVE-2007-5411"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.1,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-october/066430.html"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/25987"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/27116"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37022"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-5411"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-5411"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/37022"
},
{
"trust": 0.3,
"url": "http://www.linksys.com/servlet/satellite?c=l_product_c2\u0026childpagename=us%2flayout\u0026cid=1139414816993\u0026pagename=linksys%2fcommon%2fvisitorwrapper\u0026lid=1699354250b08"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/14032/"
},
{
"trust": 0.1,
"url": "http://secunia.com/network_software_inspector/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/27116/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28773"
},
{
"db": "BID",
"id": "25987"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-004506"
},
{
"db": "PACKETSTORM",
"id": "60069"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-250"
},
{
"db": "NVD",
"id": "CVE-2007-5411"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-28773"
},
{
"db": "BID",
"id": "25987"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-004506"
},
{
"db": "PACKETSTORM",
"id": "60069"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-250"
},
{
"db": "NVD",
"id": "CVE-2007-5411"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-10-12T00:00:00",
"db": "VULHUB",
"id": "VHN-28773"
},
{
"date": "2007-10-09T00:00:00",
"db": "BID",
"id": "25987"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-004506"
},
{
"date": "2007-10-13T01:32:46",
"db": "PACKETSTORM",
"id": "60069"
},
{
"date": "2007-10-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200710-250"
},
{
"date": "2007-10-12T18:17:00",
"db": "NVD",
"id": "CVE-2007-5411"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-29T00:00:00",
"db": "VULHUB",
"id": "VHN-28773"
},
{
"date": "2015-05-07T17:35:00",
"db": "BID",
"id": "25987"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-004506"
},
{
"date": "2007-10-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200710-250"
},
{
"date": "2025-04-09T00:30:58.490000",
"db": "NVD",
"id": "CVE-2007-5411"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200710-250"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Linksys SPA941 VoIP Phone Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-004506"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200710-250"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…