6.4

CVE-2015-0670

EPSS 0.53%
Veröffentlicht 21.03.2015 01:59:01
Zuletzt bearbeitet 12.04.2025 10:46:40
Quelle psirt@cisco.com
CVE-Watchlists
Login
Unerledigt
Login

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Cisco ≫ Spa500 Firmware Version7.5.5

Cisco ≫ Spa 501g 8-line Ip Phone

Cisco ≫ Spa 502g 1-line Ip Phone

Cisco ≫ Spa 504g 4-line Ip Phone

Cisco ≫ Spa 508g 8-line Ip Phone

Cisco ≫ Spa 509g 12-line Ip Phone

Cisco ≫ Spa 512g 1-line Ip Phone

Cisco ≫ Spa 514g 4-line Ip Phone

Cisco ≫ Spa 525g 5-line Ip Phone

Cisco ≫ Spa 525g2 5-line Ip Phone

Cisco ≫ Spa300 Firmware Version7.5.5

Cisco ≫ Spa 301 1 Line Ip Phone

Cisco ≫ Spa 302d

Cisco ≫ Spa 302dkit

Cisco ≫ Spa 303 3 Line Ip Phone

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.53%	0.66

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	6.4	10	4.9	AV:N/AC:L/Au:N/C:P/I:P/A:N

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://tools.cisco.com/security/center/viewAlert.x?alertId=37946

Vendor Advisory

http://www.securitytracker.com/id/1031969

https://nvd.nist.gov/vuln/detail/CVE-2015-0670

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-0670

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-0670

EUVD