CVE-2015-0670 — Improper Authentication in Cisco Spa300 Firmware

CWE-287 — Improper AuthenticationCWE-164 documents4 sources
Severity
6.4MEDIUMNVD
EPSS
0.3%
top 45.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Spa300 FirmwareCisco Spa500 Firmware
Timeline
PublishedMar 21
Latest updateMay 17

Description

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482.

CVSS vector

AV:N/AC:L/C:P/I:P/A:NExploitability: 10.0 | Impact: 4.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-5f5v-x476-84xc: The default configuration of Cisco Small Business IP phones SPA 300 7↗2022-05-17
▶
CVEList
CVE-2015-0670: The default configuration of Cisco Small Business IP phones SPA 300 7↗2015-03-21
▶

📋Vendor Advisories

1
Cisco
Cisco Small Business SPA300 and SPA500 Series IP Phones Unauthenticated Remote Dial Vulnerability↗2015-03-19
▶
CVE-2015-0670 — Improper Authentication in Cisco | cvebase