What’s Vulnerable › Vulnerabilities

CVE-2015-0670

• Severity: medium (CVSS 6.4 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-03-21 · updated 2026-06-17
• Weakness: CWE-287

Description

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482.

Affected products

• Cisco Spa300 Firmware: 7.5.5
• Cisco Spa500 Firmware: 7.5.5
• Cisco Spa 301 1 Line Ip Phone: all versions
• Cisco Spa 302D: all versions
• Cisco Spa 302Dkit: all versions
• Cisco Spa 303 3 Line Ip Phone: all versions
• Cisco Spa 501G 8-Line Ip Phone: all versions
• Cisco Spa 502G 1-Line Ip Phone: all versions
• Cisco Spa 504G 4-Line Ip Phone: all versions
• Cisco Spa 508G 8-Line Ip Phone: all versions
• Cisco Spa 509G 12-Line Ip Phone: all versions
• Cisco Spa 512G 1-Line Ip Phone: all versions
• Cisco Spa 514G 4-Line Ip Phone: all versions
• Cisco Spa 525G2 5-Line Ip Phone: all versions
• Cisco Spa 525G 5-Line Ip Phone: all versions

References

• http://tools.cisco.com/security/center/viewAlert.x?alertId=37946
• http://www.securitytracker.com/id/1031969
• http://tools.cisco.com/security/center/viewAlert.x?alertId=37946
• http://www.securitytracker.com/id/1031969

Get alerted when CVE-2015-0670 or the next vulnerability affects your stack