PT-2015-4797 · Cisco · Cisco Small Business Ip Phones Spa 500+1

Published 2015-03-21 · Updated 2015-10-22 · CVE-2015-0670

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Small Business IP phones SPA 300 version 7.5.5 Cisco Small Business IP phones SPA 500 version 7.5.5

Description The default configuration of the affected devices does not properly support authentication. This allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request.

Recommendations For Cisco Small Business IP phones SPA 300 version 7.5.5, update the configuration to properly support authentication. For Cisco Small Business IP phones SPA 500 version 7.5.5, update the configuration to properly support authentication.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2015-0670

Affected Products

Cisco Small Business Ip Phones Spa 300

Cisco Small Business Ip Phones Spa 500

References · 3

• http://tools.cisco.com/security/center/viewAlert.x?alertId=37946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0670 · Security Note
• http://securitytracker.com/id/1031969 · Note