CVE-2007-5469: OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages,...

Security readout for executives and security teams

This CVE describes a legacy VoIP fraud risk in OpenSER 1.2.2. If an attacker obtained Digest authentication credentials from SIP traffic, the report says they could reuse them for different call targets or caller ID spoofing. Debian disputed the issue because URI mismatches can be standards-compliant in valid deployments. Exposure appears limited to legacy OpenSER 1.2.2 SIP deployments using Digest authentication, especially where SIP signaling could be observed or credentials captured. The source bundle does not identify supported versions, package states, or a confirmed patch. Prioritize if the organization still operates legacy OpenSER 1.2.2 or exposed SIP infrastructure. The business risk is telecom fraud and caller-ID abuse, but urgency is uncertain because the issue is old, disputed, and lacks confirmed active exploitation in the provided sources. Mitigation focus: Check OpenSER, Debian, or downstream vendor guidance for supported fixes or configuration advice.; Inventory any OpenSER 1.2.2 systems and prioritize replacement of unsupported SIP infrastructure.; Restrict SIP signaling to trusted networks or protected transport paths where feasible..

Prepared

Jun 29, 2026, 02:29 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.