What is the CVSS score of CVE-2012-0333?

CVE-2012-0333 has a CVSS 2.0 base score of 5.0 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. EPSS exploitation probability: 0.3%.

Small Business Ip Phone Firmware CVE-2012-0333

MEDIUM

Improper Authentication (CWE-287)

2012-05-02 psirt@cisco.com

Cisco Authentication Bypass Small Business Ip Phone Firmware Small Business Ip Phone

5.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/Au:N/C:N/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:N/I:P/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

None

Integrity

Availability

None

Lifecycle Timeline

CVE Published

May 02, 2012 - 10:09 cve.org

MEDIUM 5.0

DescriptionCVE.org

Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768.

AnalysisAI

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768. Affected products include: Cisco Small Business Ip Phone Firmware, Cisco Small Business Ip Phone.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.