Voice Video endpoint configuration files must not be downloaded automatically during endpoint registration.

From Voice Video Policy Security Technical Implementation Guide

Associated with: CCI-002163

VVSP-01-000011_rule Voice Video endpoint configuration files must not be downloaded automatically during endpoint registration.

Vulnerability discussion

During Voice Video endpoint registration with the session controller, a file containing specific configuration settings is downloaded by the endpoint from the session manager. This file contains the phone number assigned to the endpoint, the IP addresses for session management, the software menus specific to the system, the endpoint configuration password, the stored personal preferences and speed dial numbers, and other system operational information. These configuration settings can be updated by resetting and re-registering the endpoint, which causes an updated configuration file to be downloaded.Automatic download of Voice Video endpoint configuration files during registration allows rogue endpoints to become part of the system. It also potentially allows human-readable configuration files to be sent without encryption or digital signatures.

Check content

Review the Voice Video registration policies enforced by session managers for approved Voice Video endpoints. Confirm the Voice Video endpoint configuration files are not downloaded automatically during endpoint registration. If Voice Video endpoint configuration files are downloaded automatically during endpoint registration, this is a finding.

Fix text

Document Voice Video registration policies to enforce for approved Voice Video endpoints. The Voice Video endpoint configuration files are not downloaded automatically during endpoint registration. Document Voice Video registration architecture to enforce for approved Voice Video endpoints.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.