CVEvulnerability

CVE-2015-0670

6.4 MEDIUM Published 2015-03-21 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2015-03-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-287

Description

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482.

Affected configurations

• cisco spa500 firmware 7.5.5 • cisco spa 501g 8-line ip phone • cisco spa 502g 1-line ip phone • cisco spa 504g 4-line ip phone • cisco spa 508g 8-line ip phone • cisco spa 509g 12-line ip phone • cisco spa 512g 1-line ip phone • cisco spa 514g 4-line ip phone • cisco spa 525g 5-line ip phone • cisco spa 525g2 5-line ip phone • cisco spa300 firmware 7.5.5 • cisco spa 301 1 line ip phone • cisco spa 302d • cisco spa 302dkit • cisco spa 303 3 line ip phone

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References