CVE-2015-0670 describes a vulnerability in Cisco Small Business IP phones SPA 300 and SPA 500 series, specifically versions 7.5.5, where the default configuration lacks proper authentication. This flaw allows remote attackers to read audio stream data or originate telephone calls by sending a crafted XML request. With a CVSS score of 6.4, this vulnerability is easily exploitable over the network without authentication, potentially leading to information disclosure and unauthorized call initiation. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), it has garnered some community discussion and media coverage, indicating awareness within the cybersecurity community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
7.5.5CPE matchmatch criteria | cpe:2.3:o:cisco:spa500_firmware:7.5.5:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:h:cisco:spa_501g_8-line_ip_phone:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:h:cisco:spa_502g_1-line_ip_phone:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:h:cisco:spa_504g_4-line_ip_phone:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:h:cisco:spa_508g_8-line_ip_phone:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.