CVE-2008-4875

CVE-2008-4875 is a medium-severity vulnerability in Philips Electronics Voip841 Dect Phone with a CVSS 2.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-22.

Key facts

Description

Directory traversal vulnerability in the web server in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a GET request. NOTE: this can be leveraged with CVE-2008-4874 for unauthenticated access to sensitive files such as (1) save.dat and (2) apply.log, which can contain other credentials such as the Skype username and password.

Frequently asked questions

What is CVE-2008-4875?
Directory traversal vulnerability in the web server in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a GET request. NOTE: this can be leveraged with CVE-2008-4874 for unauthenticated access to sensitive files such as (1) save.dat and (2) apply.log, which can contain other credentials such as the Skype username and password.
How severe is CVE-2008-4875?
CVE-2008-4875 has a CVSS 2.0 base score of 6.8, rated medium severity.
Is CVE-2008-4875 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (86th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2008-4875?
CVE-2008-4875 primarily affects Philips Electronics Voip841 Dect Phone. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2008-4875?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2008-4875 published?
CVE-2008-4875 was published on 2008-11-01 and last updated on 2026-06-16.

References

Affected products (2)

More vulnerabilities in Philips Electronics Voip841 Dect Phone

All CVEs affecting Philips Electronics Voip841 Dect Phone →

Other CWE-22 (Path Traversal) vulnerabilities

Browse all CWE-22 (Path Traversal) vulnerabilities →