Skip to content
CVE Tracker
Back

CVE-2007-5469

OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers…

Medium5.0EPSS 1.6%
Published
Updated
Reserved
Assigned by
mitre

Description

OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID (aka "toll fraud and authentication forward attack"). NOTE: Debian disputes this issue, stating that "having the two URIs mismatch is allowed by the standard and happens in some setups for valid reasons.

Scores

CVSS scores of CVE-2007-5469, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified2.0Medium5.0AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS (exploitation in 30 days)
1.6% · top 24% of all CVEs (3 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Weakness

Affected products

  • n/a

    • affected n/a

References (7)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2007-5469 badge
[![CVE-2007-5469](https://trackcve.app/badge/CVE-2007-5469.svg)](https://trackcve.app/cve/CVE-2007-5469)

Record last updated .