Alexander Traud

**Name of the Vulnerable Software and Affected Versions** Zyxel NBG7510 versions prior to V1.00(ABZY.3)C0 **Description** The issue is related to a DNS misconfiguration in the Zyxel NBG7510 firmware, which could allow an unauthenticated attacker to access the DNS server when the device is switched to the AP mode. This is due to insufficient access control. **Recommendations** For versions prior to V1.00(ABZY.3)C0, update the firmware to V1.00(ABZY.3)C0 or later to resolve the issue. As a temporary workaround, consider restricting access to the AP mode until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Sangoma Asterisk versions 13.38.1 through 18.2.0 Certified Asterisk version 16.8-cert5 **Description** The issue is related to incorrect access controls in the res srtp.c module, allowing a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets. **Recommendations** For Sangoma Asterisk versions 13.38.1 through 18.2.0, update to a version that includes the fix for the incorrect access controls in the res srtp.c module. For Certified Asterisk version 16.8-cert5, update to a version that includes the fix for the incorrect access controls in the res srtp.c module. As a temporary workaround, consider restricting access to the res srtp.c module to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Mitel 6800 and 6900 SIP series phones versions 5.1.0.2051 SP2 and earlier Description: A key length issue in the SRTP 128-bit key implementation could allow an attacker to launch a man-in-the-middle attack when SRTP is used in a call, potentially enabling the interception of sensitive information. Recommendations: For versions 5.1.0.2051 SP2 and earlier, update to a version later than 5.1.0.2051 SP2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Huawei CloudLink Phone 7900 version V600R019C10 **Description** The issue concerns a TLS certificate verification vulnerability in the SIP TLS module. Due to insufficient verification of specific parameters of the TLS server certificate, attackers can perform man-in-the-middle attacks. This can lead to affected phones being registered abnormally, affecting the availability of IP phones. The vulnerability can be exploited by a remote attacker to perform such attacks. **Recommendations** For Huawei CloudLink Phone 7900 version V600R019C10, consider disabling the SIP TLS module until a patch is available to prevent man-in-the-middle attacks. Restrict access to the phone's registration process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Huawei eSpace (affected versions not specified) Description: The issue allows an unauthenticated, remote attacker to launch a man-in-the-middle attack and intercept packets in non-secure transmission mode. Successful exploitation may result in the interception and tampering of call information, leading to sensitive information leaks. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Huawei eSpace (affected versions not specified) Description: The issue allows an unauthenticated, remote attacker to launch a man-in-the-middle attack and hijack the connection from a client when the user signs up to log in by TLS. This is due to insufficient authentication, which may be exploited to intercept and tamper with data information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Huawei eSpace (affected versions not specified) Description: The issue allows an unauthenticated, remote attacker to launch a man-in-the-middle attack and intercept call information when SRTP is enabled for making calls. This could lead to the leak of sensitive information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Asterisk Open Source versions 1.8.x through 11.21.1, 12.x, and 13.x through 13.7.1 Certified Asterisk versions 1.8.28, 11.6 through 11.6-cert12, and 13.1 through 13.1-cert3 **Description** The issue is related to the chan sip function in Asterisk Open Source and Certified Asterisk systems, where setting the timert1 value in sip.conf to a value greater than 1245 allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values. **Recommendations** For Asterisk Open Source versions 1.8.x through 11.21.1, update to version 11.21.1 or later. For Asterisk Open Source versions 12.x, update to version 13.7.1 or later. For Asterisk Open Source versions 13.x through 13.7.1, update to version 13.7.1 or later. For Certified Asterisk versions 1.8.28, update to version 11.6-cert12 or later. For Certified Asterisk versions 11.6 through 11.6-cert12, update to version 11.6-cert12 or later. For Certified Asterisk versions 13.1 through 13.1-cert3, update to version 13.1-cert3 or later. As a temporary workaround, consider setting the timert1 value in sip.conf to a value less than or equal to 1245 to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Mac OS X versions prior to 10.8.5 **Description** The issue concerns the IPSec implementation when Hybrid Auth is used, where it fails to verify X.509 certificates from security gateways. This allows attackers to spoof security gateways and obtain sensitive information by using a crafted certificate. **Recommendations** For versions prior to 10.8.5, update to Mac OS X version 10.8.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of Hybrid Auth until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Mac OS X versions prior to 10.8.4 **Description** The issue concerns the Private Browsing feature in CFNetwork, which fails to prevent the storage of permanent cookies when exiting Safari. This could allow physically proximate attackers to bypass cookie-based authentication by accessing an unattended workstation. **Recommendations** For Mac OS X versions prior to 10.8.4, update to version 10.8.4 or later to resolve the issue.