CVE-2007-6190: The HTTP daemon in the Cisco Unified IP Phone, when the Extension Mobility feature is enabled, allows remot...

Security readout for executives and security teams

This CVE describes a privacy risk in Cisco Unified IP Phone deployments. When Extension Mobility is enabled, an authenticated user on another phone tied to the same CUCM server may be able to make a target phone stream room audio. The source bundle does not provide CVSS, affected versions, or confirmed active exploitation. Exposure is most likely in Cisco Unified Communications Manager environments using Cisco Unified IP Phones with Extension Mobility enabled. The structured affected-product fields are incomplete, so confirm exact phone models and firmware against Cisco’s advisory. Treat this as a targeted voice-environment privacy issue, not a broad internet-scale emergency based on the supplied evidence. Prioritize organizations with Cisco IP telephony, shared phones, sensitive rooms, or Extension Mobility enabled. Mitigation focus: Review Cisco’s advisory for affected models, firmware, and fixed software guidance.; Disable Extension Mobility where it is not operationally required.; Restrict phone HTTP access to trusted voice-management networks..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.