CVE-2007-4498

CVE-2007-4498 is a high-severity vulnerability in Grandstream Sip Phone with a CVSS 2.0 base score of 7.8. Its EPSS exploit-prediction score of 14% places it in the 96th percentile, indicating an elevated likelihood of exploitation.

Key facts

Description

The Grandstream SIP Phone GXV-3000 with firmware 1.0.1.7, Loader 1.0.0.6, and Boot 1.0.0.18 allows remote attackers to force silent call completion, eavesdrop on the phone's local environment, and cause a denial of service (blocked call reception) via a certain SIP INVITE message followed by a certain "SIP/2.0 183 Session Progress" message.

Frequently asked questions

What is CVE-2007-4498?
The Grandstream SIP Phone GXV-3000 with firmware 1.0.1.7, Loader 1.0.0.6, and Boot 1.0.0.18 allows remote attackers to force silent call completion, eavesdrop on the phone's local environment, and cause a denial of service (blocked call reception) via a certain SIP INVITE message followed by a certain "SIP/2.0 183 Session Progress" message.
How severe is CVE-2007-4498?
CVE-2007-4498 has a CVSS 2.0 base score of 7.8, rated high severity.
Is CVE-2007-4498 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 14% (96th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2007-4498?
CVE-2007-4498 primarily affects Grandstream Sip Phone. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2007-4498?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2007-4498 published?
CVE-2007-4498 was published on 2007-08-23 and last updated on 2026-06-16.

References

Affected products (3)