Cisco Unified IP Phone Exposure of Sensitive Information to an Unauthorized Actor (CVE-2007-6190)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502732);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2007-6190");

  script_name(english:"Cisco Unified IP Phone Exposure of Sensitive Information to an Unauthorized Actor (CVE-2007-6190)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The HTTP daemon in the Cisco Unified IP Phone, when the Extension
Mobility feature is enabled, allows remote authenticated users of
other phones associated with the same CUCM server to eavesdrop on the
physical environment via a CiscoIPPhoneExecute message containing a
URL attribute of an ExecuteItem element that specifies a Real-Time
Transport Protocol (RTP) audio stream.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
# script_set_attribute(attribute:"see_also", value:"http://osvdb.org/40874");
  script_set_attribute(attribute:"see_also", value:"http://secunia.com/advisories/27829");
  script_set_attribute(attribute:"see_also", value:"http://securitytracker.com/id?1019006");
  # http://www.cisco.com/en/US/products/products_security_response09186a0080903a6d.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c3b32916");
# script_set_attribute(attribute:"see_also", value:"http://www.hack.lu/pres/hacklu07_Remote_wiretapping.pdf");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/26668");
  script_set_attribute(attribute:"see_also", value:"http://www.vupen.com/english/advisories/2007/4036");
# script_set_attribute(attribute:"see_also", value:"http://osvdb.org/40874");
  script_set_attribute(attribute:"see_also", value:"http://secunia.com/advisories/27829");
  script_set_attribute(attribute:"see_also", value:"http://securitytracker.com/id?1019006");
  # http://www.cisco.com/en/US/products/products_security_response09186a0080903a6d.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c3b32916");
# script_set_attribute(attribute:"see_also", value:"http://www.hack.lu/pres/hacklu07_Remote_wiretapping.pdf");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/26668");
  script_set_attribute(attribute:"see_also", value:"http://www.vupen.com/english/advisories/2007/4036");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2007-6190");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(200);

  script_set_attribute(attribute:"vuln_publication_date", value:"2007/11/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2007/11/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/12/04");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:unified_ip_phone");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/h:cisco:unified_ip_phone" :
        {"family" : "CiscoIPPhones"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_NOTE);