VulnerabilityModified
CVE-2015-0670
The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug…
MEDIUM 6.4EPSS 1.75%
Does this matter?
Lower severity and a low EPSS score (1.75%). Track it; it rarely justifies an emergency change on its own.
Description
The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482.
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
- EPSS
- 1.75% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- cisco/spa500 firmware · cisco/spa 501g 8-line ip phone · cisco/spa 502g 1-line ip phone · cisco/spa 504g 4-line ip phone · cisco/spa 508g 8-line ip phone · cisco/spa 509g 12-line ip phone · cisco/spa 512g 1-line ip phone · cisco/spa 514g 4-line ip phone · cisco/spa 525g 5-line ip phone · cisco/spa 525g2 5-line ip phone · cisco/spa300 firmware · cisco/spa 301 1 line ip phone · cisco/spa 302d · cisco/spa 302dkit · cisco/spa 303 3 line ip phone
- Source
- psirt@cisco.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.