CVE-2015-0670
Last modified
CVE-2015-0670 is a vulnerability of currently unknown severity. The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482.. EPSS estimates a 1.76% chance of exploitation in the next 30 days.
Description
The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Spa500 Firmware | 7.5.5 |
| Cisco | Spa 501g 8-Line Ip Phone | All versions |
| Cisco | Spa 502g 1-Line Ip Phone | All versions |
| Cisco | Spa 504g 4-Line Ip Phone | All versions |
| Cisco | Spa 508g 8-Line Ip Phone | All versions |
| Cisco | Spa 509g 12-Line Ip Phone | All versions |
| Cisco | Spa 512g 1-Line Ip Phone | All versions |
| Cisco | Spa 514g 4-Line Ip Phone | All versions |
| Cisco | Spa 525g 5-Line Ip Phone | All versions |
| Cisco | Spa 525g2 5-Line Ip Phone | All versions |
| Cisco | Spa300 Firmware | 7.5.5 |
| Cisco | Spa 301 1 Line Ip Phone | All versions |
| Cisco | Spa 302d | All versions |
| Cisco | Spa 302dkit | All versions |
| Cisco | Spa 303 3 Line Ip Phone | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-0670?
How severe is CVE-2015-0670?
How do I fix CVE-2015-0670?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-0664The IPC channel in Cisco AnyConnect Secure Mobility Client 4…
- CVE-2015-0665The Hostscan module in Cisco AnyConnect Secure Mobility Clie…
- CVE-2015-0666Directory traversal vulnerability in the fmserver servlet in…7.5
- CVE-2015-0667The Management Interface on Cisco Content Services Switch (C…
- CVE-2015-0668Cross-site scripting (XSS) vulnerability in the administrati…
- CVE-2015-0669The Autonomic Networking Infrastructure (ANI) implementation…
- CVE-2015-0671The DNS implementation in Cisco Videoscape Distribution Suit…
- CVE-2015-0672The DHCPv4 server in Cisco IOS XR 5.2.2 on ASR 9000 devices …
- CVE-2015-0673Cisco Mobility Services Engine (MSE) 8.0(110.0) allows remot…
- CVE-2015-0674Cross-site scripting (XSS) vulnerability in the Alert Servic…
- CVE-2015-0675The failover ipsec implementation in Cisco Adaptive Security…
- CVE-2015-0676The DNS implementation in Cisco Adaptive Security Appliance …
Are you affected by CVE-2015-0670?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST