What’s Vulnerable › Vulnerabilities

CVE-2014-3312

• Severity: medium (CVSS 6.9 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-07-09 · updated 2026-06-17
• Weakness: CWE-287

Description

The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435.

Affected products

• Cisco Spa901 1-Line Ip Phone: all versions
• Cisco Spa922 1-Line Ip Phone With 1-Port Ethernet: all versions
• Cisco Spa941 4-Line Ip Phone With 1-Port Ethernet: all versions
• Cisco Spa942 4-Line Ip Phone With 2-Port Switch: all versions
• Cisco Spa962 6-Line Ip Phone With 2-Port Switch: all versions
• Cisco Spa 301 1 Line Ip Phone: all versions
• Cisco Spa 303 3 Line Ip Phone: all versions
• Cisco Spa 501G 8-Line Ip Phone: all versions
• Cisco Spa 502G 1-Line Ip Phone: all versions
• Cisco Spa 504G 4-Line Ip Phone: all versions
• Cisco Spa 508G 8-Line Ip Phone: all versions
• Cisco Spa 509G 12-Line Ip Phone: all versions
• Cisco Spa 512G 1-Line Ip Phone: all versions
• Cisco Spa 514G 4-Line Ip Phone: all versions
• Cisco Spa 525G2 5-Line Ip Phone: all versions
• Cisco Spa 525G 5-Line Ip Phone: all versions

References

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3312
• http://www.securityfocus.com/bid/68465
• http://www.securitytracker.com/id/1030552
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94421
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3312
• http://www.securityfocus.com/bid/68465
• http://www.securitytracker.com/id/1030552
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94421

Get alerted when CVE-2014-3312 or the next vulnerability affects your stack