Linksys SPA941 vulnerabilities

2 CVEs affecting Linksys SPA941, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2007-5411, published 2007-10-12.

More from Linksys.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2007-2270, published 2007-04-25. High severity, CVSS 7.8. EPSS: 9.4% chance of exploitation in the next 30 days. The Linksys SPA941 VoIP Phone allows remote attackers to cause a denial of service (device reboot) via a 0377 (0xff) character in the From header, and possibly certain other locations, in a SIP…
• CVE-2007-5411, published 2007-10-12. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Linksys SPA941 VoIP Phone with firmware 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the From header in a SIP message.