CVE-2007-3368: Buffer overflow in the HTTP server on the Polycom SoundPoint IP 601 SIP phone with BootROM 3.0.x+ allows re...

Security readout for executives and security teams

This CVE describes a flaw in the HTTP server on Polycom SoundPoint IP 601 SIP phones with BootROM 3.0.x+. A malformed CGI parameter can overflow a buffer and reboot the device, disrupting phone availability. The provided sources do not show data theft, code execution, or confirmed exploitation. Exposure is most likely where the phone HTTP management interface is reachable from user, guest, VPN, or internet-facing networks. Organizations without this legacy handset model or BootROM line are likely not exposed based on the provided evidence. Treat this as a targeted availability risk for legacy voice infrastructure, not a broad enterprise compromise signal. Prioritize if these phones support critical operations or if their web interfaces are reachable beyond a tightly controlled management network. Mitigation focus: Identify any Polycom SoundPoint IP 601 phones and BootROM versions.; Restrict access to phone HTTP management interfaces to trusted admin networks.; Disable exposed HTTP management if vendor-supported and operationally acceptable..

Prepared

Jun 29, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.