Snom manufactures IP telephony equipment, particularly SIP phones in its 300 and 320 series, deployed across small-to-medium business and enterprise voice infrastructure. Its vulnerability exposure centers on web-management interfaces and firmware components, where the recurring weakness classes—including cross-site request forgery, authentication bypass, input validation flaws, and cross-site scripting—reflect the attack surface of embedded web applications with limited code-review rigor. Vulnerabilities affecting this vendor skew toward serious outcomes; live severity, exploitation, and current exposure details are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Snom over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2009-1048CRITICAL The web interface on the snom VoIP phones snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 6.5 before 6.5.20, 7.1 before 7.1.39, and 7.3 before 7.3.14 allows remo | Aug 14, 2009 | 9.8 | 28 | NO | NO |
CVE-2008-1249HIGH snomControl.swf in the central phone server for the Snom 320 SIP Phone allows remote attackers to cause a denial of service (application crash and corruption of call logs) via a "' | Mar 10, 2008 | 9.4 | 28 | NO | NO |
CVE-2008-1250HIGH Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as | Mar 10, 2008 | 9.3 | 27 | NO | NO |
CVE-2008-1248MEDIUM The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "Call a number" field. NOTE: this might over | Mar 10, 2008 | 5.8 | 21 | NO | NO |
CVE-2007-3440MEDIUM The Snom 320 SIP Phone, running snom320 linux 3.25, snom320-SIP 6.2.3, and snom320 jffs23.36, allows remote attackers to place calls to arbitrary phone numbers via certain requests | Jun 27, 2007 | 6.4 | 18 | NO | NO |
CVE-2008-1251MEDIUM Cross-site scripting (XSS) vulnerability in the web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to inject arbitrary web script or HTML | Mar 10, 2008 | 4.3 | 17 | NO | NO |
CVE-2007-3439MEDIUM The Snom 320 SIP Phone, running snom320 linux 3.25, snom320-SIP 6.2.3, and snom320 jffs23.36, allows remote attackers to read a list of missed calls, received calls, and dialed num | Jun 27, 2007 | 5.0 | 15 | NO | NO |
Unspecified vulnerability in the web interface in snom VoIP Phone firmware 8 before 8.2.35 allows remote attackers to bypass intended restrictions and modify user credentials via u | Jun 15, 2010 | 3.3 | 13 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Snom.
Media articles that mention a CVE ID that affects a product developed by Snom — matched by CVE ID, not by vendor name.