Authentication flaw

2012-05-0210:09:00

PRIOn knowledge base

www.prio-n.com

7.6 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

56.7%

JSON

Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768.

CPENameOperatorVersion
small_business_ip_phoneeq525.0.0-g-spa
small_business_ip_phoneeq525g2-spa
small_business_ip_phone_firmwarele7.4.9
small_business_ip_phone_firmwareeq7.1.7
small_business_ip_phone_firmwareeq7.2.5
small_business_ip_phone_firmwareeq7.3.5
small_business_ip_phone_firmwareeq7.4.3
small_business_ip_phone_firmwareeq7.4.4
small_business_ip_phone_firmwareeq7.4.5
small_business_ip_phone_firmwareeq7.4.6

Name	Operator	Version
small_business_ip_phone	eq	525.0.0-g-spa
small_business_ip_phone	eq	525g2-spa
small_business_ip_phone_firmware	le	7.4.9
small_business_ip_phone_firmware	eq	7.1.7
small_business_ip_phone_firmware	eq	7.2.5
small_business_ip_phone_firmware	eq	7.3.5
small_business_ip_phone_firmware	eq	7.4.3
small_business_ip_phone_firmware	eq	7.4.4
small_business_ip_phone_firmware	eq	7.4.5
small_business_ip_phone_firmware	eq	7.4.6