How severe is CVE-2002-0670?

CVE-2002-0670 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2002-0670 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2002-0670?

CVE-2002-0670 primarily affects Pingtel Xpressa. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2002-0670?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2002-0670 published?

CVE-2002-0670 was published on 2002-07-23 and last updated on 2026-06-16.

CVE-2002-0670

CVE-2002-0670 is a high-severity vulnerability in Pingtel Xpressa with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 2.0 base score 7.5)
EPSS exploit prediction: 2% (73rd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Pingtel Xpressa
Published: 2002-07-23
Last modified: 2026-06-16

Description

The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 uses Base64 encoded usernames and passwords for HTTP basic authentication, which allows remote attackers to steal and easily decode the passwords via sniffing.

Frequently asked questions

What is CVE-2002-0670?: The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 uses Base64 encoded usernames and passwords for HTTP basic authentication, which allows remote attackers to steal and easily decode the passwords via sniffing.
How severe is CVE-2002-0670?: CVE-2002-0670 has a CVSS 2.0 base score of 7.5, rated high severity.
Is CVE-2002-0670 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2002-0670?: CVE-2002-0670 primarily affects Pingtel Xpressa. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2002-0670?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2002-0670 published?: CVE-2002-0670 was published on 2002-07-23 and last updated on 2026-06-16.

References

Affected products (2)

cpe:2.3:h:pingtel:xpressa:1.2.5:*:*:*:*:*:*:*
cpe:2.3:h:pingtel:xpressa:1.2.7.4:*:*:*:*:*:*:*

More vulnerabilities in Pingtel Xpressa

CVE-2002-0667 — Critical (CVSS 10.0): Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 has a default null administrator password, which…
CVE-2002-0668 — High (CVSS 7.5): The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows authenticated users to…
CVE-2002-0674 — High (CVSS 7.2): Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 does not "time out" an inactive administrator…
CVE-2004-1680 — Medium (CVSS 5.0): application.cgi in the Pingtel Xpressa handset running firmware 2.1.11.24 allows remote authenticated users to cause a…
CVE-2002-0669 — Medium (CVSS 5.0): The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows administrators to…
CVE-2002-1935 — Medium (CVSS 5.0): Pingtel Xpressa 1.2.5 through 2.0.1 uses predictable (1) Call-ID, (2) CSeq, and (3) "To" and "From" SIP URL values in a…

All CVEs affecting Pingtel Xpressa →