{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T11:32:00Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"cisco-sa-20070221-phone","slug":"cisco-sa-20070221-phone","vendor":"Cisco","title":"Cisco Unified IP Conference Station and IP Phone Vulnerabilities","summary":"Certain Cisco Unified IP Conference Station and IP Phone devices contain vulnerabilities which may allow unauthorized users to gain administrative access to vulnerable devices. Cisco Unified IP Conference Station Administrative Bypass Vulnerability Cisco Unified IP Conference Station 7935 and 7936 devices do not require a password when a URL is accessed directly via the administrator HTTP interface. There is a workaround for this vulnerability. Cisco Unified IP Phone Default Account and Privilege Escalation Vulnerabilities Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G and 7971G devices contain a hard coded default user account with a default password which is remotely accessible via a Secure Shell (SSH) server enabled on the phone. This default user account may be leveraged to gain administrative access to a vulnerable phone via a privilege escalation vulnerability. The default user account may also execute commands causing a phone to become unstable and result in a denial of service. The default user account can not be disabled, removed or have its password changed. There are mitigations available for these vulnerabilities. Cisco has made free software available to address these issues for affected customers. This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone.","severity":"Critical","published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/cisco-sa-20070221-phone/csaf/cisco-sa-20070221-phone.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":3,"visible_product_count":8,"public_evidence_count":14,"kev_count":0,"highest_epss":0.00323},"cves":[{"id":"CVE-2007-1072","kev":false,"epss":{"score":0.00323,"percentile":0.24519,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"}},{"id":"CVE-2007-1063","kev":false},{"id":"CVE-2007-1062","kev":false}],"public_evidence":[{"product":{"name":"Cisco Unified IP Phone 7906G","slug":"cisco-unified-ip-phone-7906g","vendor":"Cisco"},"cve":{"id":"CVE-2007-1072"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Phone 7906G","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00323,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":1},{"product":{"name":"Cisco Unified IP Phone 7911G","slug":"cisco-unified-ip-phone-7911g","vendor":"Cisco"},"cve":{"id":"CVE-2007-1072"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Phone 7911G","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00323,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":2},{"product":{"name":"Cisco Unified IP Phone 7941G","slug":"cisco-unified-ip-phone-7941g","vendor":"Cisco"},"cve":{"id":"CVE-2007-1072"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Phone 7941G","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00323,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":3},{"product":{"name":"Cisco Unified IP Phone 7961G","slug":"cisco-unified-ip-phone-7961g","vendor":"Cisco"},"cve":{"id":"CVE-2007-1072"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Phone 7961G","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00323,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":4},{"product":{"name":"Cisco Unified IP Phone 7970G","slug":"cisco-unified-ip-phone-7970g","vendor":"Cisco"},"cve":{"id":"CVE-2007-1072"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Phone 7970G","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00323,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":5},{"product":{"name":"Cisco Unified IP Phone 7971G","slug":"cisco-unified-ip-phone-7971g","vendor":"Cisco"},"cve":{"id":"CVE-2007-1072"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Phone 7971G","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00323,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":6},{"product":{"name":"Cisco Unified IP Phone 7906G","slug":"cisco-unified-ip-phone-7906g","vendor":"Cisco"},"cve":{"id":"CVE-2007-1063"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Phone 7906G","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":7},{"product":{"name":"Cisco Unified IP Phone 7911G","slug":"cisco-unified-ip-phone-7911g","vendor":"Cisco"},"cve":{"id":"CVE-2007-1063"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Phone 7911G","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":8},{"product":{"name":"Cisco Unified IP Phone 7941G","slug":"cisco-unified-ip-phone-7941g","vendor":"Cisco"},"cve":{"id":"CVE-2007-1063"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Phone 7941G","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":9},{"product":{"name":"Cisco Unified IP Phone 7961G","slug":"cisco-unified-ip-phone-7961g","vendor":"Cisco"},"cve":{"id":"CVE-2007-1063"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Phone 7961G","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":10},{"product":{"name":"Cisco Unified IP Phone 7970G","slug":"cisco-unified-ip-phone-7970g","vendor":"Cisco"},"cve":{"id":"CVE-2007-1063"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Phone 7970G","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":11},{"product":{"name":"Cisco Unified IP Phone 7971G","slug":"cisco-unified-ip-phone-7971g","vendor":"Cisco"},"cve":{"id":"CVE-2007-1063"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Phone 7971G","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":12},{"product":{"name":"Cisco Unified IP Conference Station 7935","slug":"cisco-unified-ip-conference-station-7935","vendor":"Cisco"},"cve":{"id":"CVE-2007-1062"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Conference Station 7935","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":13},{"product":{"name":"Cisco Unified IP Conference Station 7936","slug":"cisco-unified-ip-conference-station-7936","vendor":"Cisco"},"cve":{"id":"CVE-2007-1062"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:35Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Conference Station 7936","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"published_at":"2007-02-21T16:00:00Z","updated_at":"2007-02-21T16:00:00Z","advisory_updated_at":"2007-02-21T16:00:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070221-phone","row_display_order":14}]}