What is the CVSS score of CVE-2014-3312?

CVE-2014-3312 has a CVSS 2.0 base score of 6.9 (Medium). CVSS vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 0.1%.

Spa 301 1 Line Ip Phone CVE-2014-3312

MEDIUM

Improper Authentication (CWE-287)

2014-07-09 psirt@cisco.com

Cisco Authentication Bypass Spa 301 1 Line Ip Phone Spa 303 3 Line Ip Phone Spa 501G 8 Line Ip Phone Spa 502G 1 Line Ip Phone Spa 504G 4 Line Ip Phone Spa 508G 8 Line Ip Phone Spa 509G 12 Line Ip Phone Spa 512G 1 Line Ip Phone Spa 514G 4 Line Ip Phone Spa 525G 5 Line Ip Phone Spa 525G2 5 Line Ip Phone Spa901 1 Line Ip Phone Spa922 1 Line Ip Phone With 1 Port Ethernet Spa941 4 Line Ip Phone With 1 Port Ethernet Spa942 4 Line Ip Phone With 2 Port Switch Spa962 6 Line Ip Phone With 2 Port Switch

6.9

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

AV:L/AC:M/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:M/Au:N/C:C/I:C/A:C

Attack Vector

Local

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jul 09, 2014 - 11:07 cve.org

MEDIUM 6.9

DescriptionCVE.org

The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435.

AnalysisAI

The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or. Rated medium severity (CVSS 6.9). No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435. Affected products include: Cisco Spa 301 1 Line Ip Phone, Cisco Spa 303 3 Line Ip Phone, Cisco Spa 501G 8-Line Ip Phone, Cisco Spa 502G 1-Line Ip Phone, Cisco Spa 504G 4-Line Ip Phone.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.