Due to ignoring the value of Call-ID and even tag and branch while processing NOTIFY messages, VOIP-Hardphones process spoofed status messages like Messages-Waiting.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/38521/voip-phones.txt
Source: https://packetstormsecurity.com/files/38521/voip-phones.txt.html