Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2007-1063: Cisco IP Phone firmware allows remote login with default credentials

CVE-2007-1063 · published 19 years ago

Summary

Certain Cisco Unified IP Phone models (7906G, 7911G, 7941G, 7961G, 7970G, 7971G) running firmware 8.0(4)SR1 or earlier have a built-in username and password for their SSH service. This lets someone on the network connect to the phone and control it without permission. Update the phone firmware to the latest version or disable SSH if it is not needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cisco	unified_ip_phone_firmware_7906g	8.0\(4\) `cpe:2.3:o:cisco:unified_ip_phone_firmware_7906g:8.0\(4\):sr1::::::`
cisco	unified_ip_phone_firmware_7911g	8.0\(4\) `cpe:2.3:o:cisco:unified_ip_phone_firmware_7911g:8.0\(4\):sr1::::::`
cisco	unified_ip_phone_firmware_7941g	8.0\(4\) `cpe:2.3:o:cisco:unified_ip_phone_firmware_7941g:8.0\(4\):sr1::::::`
cisco	unified_ip_phone_firmware_7961g	8.0\(4\) `cpe:2.3:o:cisco:unified_ip_phone_firmware_7961g:8.0\(4\):sr1::::::`
cisco	unified_ip_phone_firmware_7970g	8.0\(4\) `cpe:2.3:o:cisco:unified_ip_phone_firmware_7970g:8.0\(4\):sr1::::::`
cisco	unified_ip_phone_firmware_7971g	8.0\(4\) `cpe:2.3:o:cisco:unified_ip_phone_firmware_7971g:8.0\(4\):sr1::::::`

Original advisory text

The SSH server in Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G, and 7971G, with firmware 8.0(4)SR1 and earlier, uses a hard-coded username and password, which allows remote attackers to...

References

http://osvdb.org/45246 Broken Link
http://secunia.com/advisories/24262 Vendor Advisory
http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtml Vendor Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml Patch Vendor Advisory
http://www.securityfocus.com/bid/22647 Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1017681 Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2007/0689 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/32627 Third Party Advisory VDB Entry

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

10.0 Critical

Exploitation

3% chance of attack within 30 days

Type

CWE-798Use of Hard-coded Credentials

Timeline

Published22 Feb 2007

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2007-1063 · NVD

Track software like this

Free during beta