What is the CVSS score of CVE-2015-0670?

CVE-2015-0670 has a CVSS 2.0 base score of 6.4 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:N. EPSS exploitation probability: 0.3%.

Spa500 Firmware CVE-2015-0670

MEDIUM

Improper Authentication (CWE-287)

2015-03-21 psirt@cisco.com

Cisco Authentication Bypass Spa500 Firmware Spa 501G 8 Line Ip Phone Spa 502G 1 Line Ip Phone Spa 504G 4 Line Ip Phone Spa 508G 8 Line Ip Phone Spa 509G 12 Line Ip Phone Spa 512G 1 Line Ip Phone Spa 514G 4 Line Ip Phone Spa 525G 5 Line Ip Phone Spa 525G2 5 Line Ip Phone Spa300 Firmware Spa 301 1 Line Ip Phone Spa 302D Spa 302Dkit Spa 303 3 Line Ip Phone

6.4

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/Au:N/C:P/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:P/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Mar 21, 2015 - 01:59 cve.org

MEDIUM 6.4

DescriptionCVE.org

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482.

AnalysisAI

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482. Affected products include: Cisco Spa500 Firmware, Cisco Spa 501G 8-Line Ip Phone, Cisco Spa 502G 1-Line Ip Phone, Cisco Spa 504G 4-Line Ip Phone, Cisco Spa 508G 8-Line Ip Phone.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.