6.4

CVE-2015-0670

EPSS 0.53%
Published 21.03.2015 01:59:01
Last modified 12.04.2025 10:46:40
Source psirt@cisco.com
Teams watchlist Login
Open Login

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482.

Affected products Warnungen 0 Metrics 2 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Cisco ≫ Spa500 Firmware Version7.5.5

Cisco ≫ Spa 501g 8-line Ip Phone

Cisco ≫ Spa 502g 1-line Ip Phone

Cisco ≫ Spa 504g 4-line Ip Phone

Cisco ≫ Spa 508g 8-line Ip Phone

Cisco ≫ Spa 509g 12-line Ip Phone

Cisco ≫ Spa 512g 1-line Ip Phone

Cisco ≫ Spa 514g 4-line Ip Phone

Cisco ≫ Spa 525g 5-line Ip Phone

Cisco ≫ Spa 525g2 5-line Ip Phone

Cisco ≫ Spa300 Firmware Version7.5.5

Cisco ≫ Spa 301 1 Line Ip Phone

Cisco ≫ Spa 302d

Cisco ≫ Spa 302dkit

Cisco ≫ Spa 303 3 Line Ip Phone

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.53%	0.66

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.4	10	4.9	AV:N/AC:L/Au:N/C:P/I:P/A:N

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://tools.cisco.com/security/center/viewAlert.x?alertId=37946

Vendor Advisory

http://www.securitytracker.com/id/1031969

https://nvd.nist.gov/vuln/detail/CVE-2015-0670

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-0670

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-0670

EUVD