What is the CVSS score of CVE-2015-0670?

CVE-2015-0670 has a CVSS 2.0 base score of 6.4 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:N. EPSS exploitation probability: 0.3%.

Spa 501G 8 Line Ip Phone CVE-2015-0670

MEDIUM

Improper Authentication (CWE-287)

2015-03-21 psirt@cisco.com

Authentication Bypass Cisco Spa 501G 8 Line Ip Phone Spa 502G 1 Line Ip Phone Spa 504G 4 Line Ip Phone Spa 508G 8 Line Ip Phone Spa 509G 12 Line Ip Phone Spa 512G 1 Line Ip Phone Spa 514G 4 Line Ip Phone Spa 525G 5 Line Ip Phone Spa 525G2 5 Line Ip Phone Spa 301 1 Line Ip Phone Spa 303 3 Line Ip Phone Spa500 Firmware Spa300 Firmware Spa 302D Spa 302Dkit

6.4

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/Au:N/C:P/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Mar 21, 2015 - 01:59 cve.org

MEDIUM 6.4

DescriptionCVE.org

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482.

AnalysisAI

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482. Affected products include: Cisco Spa500 Firmware, Cisco Spa 501G 8-Line Ip Phone, Cisco Spa 502G 1-Line Ip Phone, Cisco Spa 504G 4-Line Ip Phone, Cisco Spa 508G 8-Line Ip Phone.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.