VOIP product allows authentication bypass using 127.0.0.1 in the Host header.
CVE-2009-2213
product uses default "Allow" action, instead of default deny, leading to authentication bypass.
CVE-2009-2168