Xpressa

Vendor:

First CVE: Jul 23, 2002 · Active for 24 years

12

Total CVEs

More Total CVEs than 90% of tracked products

4.0

Avg CVEs / Year

Higher CVE frequency than 83% of tracked products

6.3

Avg CVSS

Higher Avg CVSS than 26% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Xpressa over time

Volume of CVEsAvg CVSS Base Score

First CVE

Jul 23, 2002

24 years ago

Most Recent CVE

Sep 13, 2004

7,985 days ago

CVE Severity & Scoring

Xpressa12 CVEs

58%

33%

8%

All CVEs352,708 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local0 (0.0%)

Network1 (8.3%)

Unknown11 (91.7%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low1 (8.3%)

High0 (0.0%)

Unknown11 (91.7%)

User Interaction

None1 (8.3%)

Unknown11 (91.7%)

Required0 (0.0%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None1 (8.3%)

Unknown11 (91.7%)

Top CVEs

Signals from CVEs in this product scope (12 CVEs).

12 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2002-0667HIGH Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 has a default null administrator password, which could allow remote attackers to gain access to the phone.	Jul 23, 2002	10.0	31	NO	NO
CVE-2002-0671CRITICAL Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could a	Jul 23, 2002	9.8	29	NO	NO
CVE-2002-0674HIGH Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 does not "time out" an inactive administrator session, which could allow other users to perform administrator ac	Jul 23, 2002	7.2	23	NO	NO
CVE-2002-0668HIGH The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows authenticated users to modify the Call Forwarding settings and hijack calls.	Jul 23, 2002	7.5	19	NO	NO
CVE-2002-0670HIGH The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 uses Base64 encoded usernames and passwords for HTTP basic authentication, which allows re	Jul 23, 2002	7.5	19	NO	NO
CVE-2002-0673MEDIUM The enrollment process for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows attackers with physical access to the phone to log out the current user and re	Jul 23, 2002	4.6	18	NO	NO
CVE-2002-0675MEDIUM Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 does not require administrative privileges to perform a firmware upgrade, which allows unauthorized users to upg	Jul 23, 2002	4.6	18	NO	NO
CVE-2004-1680MEDIUM application.cgi in the Pingtel Xpressa handset running firmware 2.1.11.24 allows remote authenticated users to cause a denial of service (VxWorks OS crash) via a long HTTP GET requ	Sep 13, 2004	5.0	15	NO	NO
CVE-2002-0669MEDIUM The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows administrators to cause a denial of service by modifying the SIP_AUTHENTICATE_SCHEM	Feb 19, 2003	5.0	15	NO	NO
CVE-2002-1934MEDIUM Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 2.0.1 leaks sensitive information during boot-up, which allows attackers to obtain the MD5 hash of the Admin password, M	Dec 31, 2002	5.0	15	NO	NO

View all 12 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (12 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

0 CVEs

0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (12 CVEs).

Media Mentions

Signals from CVEs in this product scope (12 CVEs).

Top CNAs Publishing CVEs For Xpressa

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS
2.1.11.24	1	5.0	1.9%
2.0.1	3	5.0	1.5%
2.0	3	5.0	1.5%
1.2.8	3	5.0	1.5%
1.2.7.4	11	6.0	1.1%
1.2.5	11	6.0	1.1%