Pingtel's vulnerability profile centers on its Xpressa unified communications appliance and related firmware, a narrowly scoped product line serving enterprise voice and messaging deployments. The recurring exposure involves code-integrity and download-validation weaknesses, reflecting the risks inherent to firmware update mechanisms and embedded system trust chains. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Pingtel over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2002-0667HIGH Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 has a default null administrator password, which could allow remote attackers to gain access to the phone. | Jul 23, 2002 | 10.0 | 31 | NO | NO |
CVE-2002-0671CRITICAL Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could a | Jul 23, 2002 | 9.8 | 29 | NO | NO |
CVE-2002-0674HIGH Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 does not "time out" an inactive administrator session, which could allow other users to perform administrator ac | Jul 23, 2002 | 7.2 | 23 | NO | NO |
CVE-2002-0668HIGH The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows authenticated users to modify the Call Forwarding settings and hijack calls. | Jul 23, 2002 | 7.5 | 19 | NO | NO |
CVE-2002-0670HIGH The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 uses Base64 encoded usernames and passwords for HTTP basic authentication, which allows re | Jul 23, 2002 | 7.5 | 19 | NO | NO |
CVE-2002-0673MEDIUM The enrollment process for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows attackers with physical access to the phone to log out the current user and re | Jul 23, 2002 | 4.6 | 18 | NO | NO |
CVE-2002-0675MEDIUM Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 does not require administrative privileges to perform a firmware upgrade, which allows unauthorized users to upg | Jul 23, 2002 | 4.6 | 18 | NO | NO |
CVE-2004-1680MEDIUM application.cgi in the Pingtel Xpressa handset running firmware 2.1.11.24 allows remote authenticated users to cause a denial of service (VxWorks OS crash) via a long HTTP GET requ | Sep 13, 2004 | 5.0 | 15 | NO | NO |
CVE-2002-0669MEDIUM The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows administrators to cause a denial of service by modifying the SIP_AUTHENTICATE_SCHEM | Feb 19, 2003 | 5.0 | 15 | NO | NO |
CVE-2002-1934MEDIUM Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 2.0.1 leaks sensitive information during boot-up, which allows attackers to obtain the MD5 hash of the Admin password, M | Dec 31, 2002 | 5.0 | 15 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Pingtel.
Media articles that mention a CVE ID that affects a product developed by Pingtel — matched by CVE ID, not by vendor name.