CVE-2007-3347
The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's...
The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID.
Exploit likelihood
What each source reports
NVD Score used
The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID.
- Record
CVE-2007-3347- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:C/A:N - Updated
- 2026-11-02
CVE List No score
The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID.
- Record
CVE-2007-3347- Updated
- 2026-11-02
EUVDEUVD-2007-3337 No score
The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID.
- Record
EUVD-2007-3337- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w8vh-crmm-4pp5 No score
The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's...
The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID.
- Record
GHSA-w8vh-crmm-4pp5- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, references, title | GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3347 is a high vulnerability (CVSS 7.8) in D-link Dph-540, published June 22, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. No source names a fixed version.
References
sipera.com/index.php?action=resources%2Cthreat_advisory&tid=219&
vupen.com/english/advisories/2007/2320
secunia.com/advisories/25803
securityfocus.com/bid/24560
exchange.xforce.ibmcloud.com/vulnerabilities/35063
nvd.nist.gov/vuln/detail/CVE-2007-3347
github.com/advisories/GHSA-w8vh-crmm-4pp5