CVE-2014-3313

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-09 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the web user interface on Cisco Small Business SPA300 and SPA500 phones allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuo52582.

Affected products

Cisco Spa901 1-Line Ip Phone: all versions
Cisco Spa922 1-Line Ip Phone With 1-Port Ethernet: all versions
Cisco Spa941 4-Line Ip Phone With 1-Port Ethernet: all versions
Cisco Spa942 4-Line Ip Phone With 2-Port Switch: all versions
Cisco Spa962 6-Line Ip Phone With 2-Port Switch: all versions
Cisco Spa 301 1 Line Ip Phone: all versions
Cisco Spa 303 3 Line Ip Phone: all versions
Cisco Spa 501G 8-Line Ip Phone: all versions
Cisco Spa 502G 1-Line Ip Phone: all versions
Cisco Spa 504G 4-Line Ip Phone: all versions
Cisco Spa 508G 8-Line Ip Phone: all versions
Cisco Spa 509G 12-Line Ip Phone: all versions
Cisco Spa 512G 1-Line Ip Phone: all versions
Cisco Spa 514G 4-Line Ip Phone: all versions
Cisco Spa 525G2 5-Line Ip Phone: all versions
Cisco Spa 525G 5-Line Ip Phone: all versions

References

Get alerted when CVE-2014-3313 or the next vulnerability affects your stack