Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

MultiVOIP devices can be taken over via crafted SIP calls

CVE-2005-4050 · published 20 years ago
Summary

Certain Multi-Tech MultiVOIP phones with firmware older than version x.08 can be tricked into running unwanted programs when they receive a specially crafted phone‑call request. This could let an attacker control the device from a distance. Upgrade the firmware to the latest version or apply the vendor’s security patch as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
multi-tech_systems multivoip All versions
cpe:2.3:h:multi-tech_systems:multivoip:*:*:*:*:*:*:*:*
Original advisory text
Buffer overflow in multiple Multi-Tech Systems MultiVOIP devices with firmware before x.08 allows remote attackers to execute arbitrary code via a long INVITE field in a Session Initiation Protocol...
Buffer overflow in multiple Multi-Tech Systems MultiVOIP devices with firmware before x.08 allows remote attackers to execute arbitrary code via a long INVITE field in a Session Initiation Protocol (SIP) packet.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
4% chance of attack within 30 days
Timeline
Published7 Dec 2005
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2005-4050 · NVD
Track software like this
Free during beta