CVE-2007-0528 — The admin web console implemented by the Centrality Communications (aka Aredfox) PA168 chipset and firmware 1.54 and earlier, as provided by various IP phones, does not require passwords or authentication tokens when using HTTP, which allows remote attackers to connect to existing superuser sessions and obtain sensitive information (passwords and configuration data)

Back Back to CVE browser

HIGH

The admin web console implemented by the Centrality Communications (aka Aredfox) PA168 chipset and firmware 1.54 and earlier, as provided by various IP phones, does not require passwords or authentication tokens when using HTTP, which allows remote attackers to connect to existing superuser sessions and obtain sensitive information (passwords and configuration data)

Published Jan 26, 2007

9.0

HIGH

CVSS 2.0

EPSS 4.49%

Description

The admin web console implemented by the Centrality Communications (aka Aredfox) PA168 chipset and firmware 1.54 and earlier, as provided by various IP phones, does not require passwords or authentication tokens when using HTTP, which allows remote attackers to connect to existing superuser sessions and obtain sensitive information (passwords and configuration data).

Affected products

Remediation

No remediation recorded yet.

Metrics

4.49% 0.04487

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.04487

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (14 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	4.49% (0.04487)	91.17th	v5 (v2026.06.15)
Jun 15, 2026	4.35% (0.04349)	89.93th	v5 (v2026.06.15)
Sep 27, 2025	15.01% (0.15008)	94.34th	v4 (v2025.03.14)
Mar 30, 2025	8.85% (0.08845)	91.72th	v4 (v2025.03.14)
Mar 29, 2025	12.94% (0.12941)	90.07th	v4 (v2025.03.14)
Mar 17, 2025	8.85% (0.08845)	91.91th	v4 (v2025.03.14)
Dec 12, 2024	2.36% (0.02357)	90.19th	v3 (v2023.03.01)
May 1, 2024	2.36% (0.02357)	89.68th	v3 (v2023.03.01)
Oct 22, 2023	2.65% (0.02645)	89.19th	v3 (v2023.03.01)
Jun 29, 2023	2.75% (0.02754)	89.11th	v3 (v2023.03.01)
Mar 7, 2023	2.74% (0.02745)	88.90th	v3 (v2023.03.01)
Mar 6, 2023	5.93% (0.05931)	90.54th	v2 (v2022.01.01)
Apr 1, 2022	5.93% (0.05931)	89.63th	v2 (v2022.01.01)
Feb 4, 2022	5.93% (0.05931)	77.48th	v2 (v2022.01.01)

Weaknesses (0)

No CWE recorded.

References (7)

http://osvdb.org/32966
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/23919
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/23936
third-party-advisoryx_refsource_SECUNIA
http://www.procheckup.com/Vulner_PR0614.php
x_refsource_MISCVendor Advisory
http://www.securityfocus.com/archive/1/457868/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.vupen.com/english/advisories/2007/0346
vdb-entryx_refsource_VUPEN
https://www.exploit-db.com/exploits/3189
exploitx_refsource_EXPLOIT-DB

Link	Providers	Tags
http://osvdb.org/32966		vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/23919		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/23936		third-party-advisoryx_refsource_SECUNIA
http://www.procheckup.com/Vulner_PR0614.php		x_refsource_MISCVendor Advisory
http://www.securityfocus.com/archive/1/457868/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.vupen.com/english/advisories/2007/0346		vdb-entryx_refsource_VUPEN
https://www.exploit-db.com/exploits/3189		exploitx_refsource_EXPLOIT-DB

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jan 26, 2007

Updated Aug 7, 2024

Reserved Jan 25, 2007

Link CVE-2007-0528

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2007-0528

Red Hat

Severity n/a

Public date n/a

Links CVE-2007-0528