CVE-2012-0333

Published: May 2, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768.

Affected (12)

Products: Cisco: Small Business Ip Phone Firmware, Small Business Ip Phone

Cisco

2 products

Small Business Ip Phone Firmware

Small Business Ip Phone

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Cisco Small Business Ip Phone Firmware	Up to 7.4.9
Cisco Small Business Ip Phone Firmware	Version 7.1.7
Cisco Small Business Ip Phone Firmware	Version 7.2.5
Cisco Small Business Ip Phone Firmware	Version 7.3.5
Cisco Small Business Ip Phone Firmware	Version 7.4.3
Cisco Small Business Ip Phone Firmware	Version 7.4.4
Cisco Small Business Ip Phone Firmware	Version 7.4.5
Cisco Small Business Ip Phone Firmware	Version 7.4.6
Cisco Small Business Ip Phone Firmware	Version 7.4.7
Cisco Small Business Ip Phone Firmware	Version 7.4.8
Cisco Small Business Ip Phone	Version spa525g2
Cisco Small Business Ip Phone	Version spa525g

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

http://www-europe.cisco.com/en/US/docs/voice_ip_comm/csbpipp/ip_phones/release/notes/spa525g_relnote_7_5_1.pdf

Source: psirt@cisco.com

http://www.securitytracker.com/id?1027012

Source: psirt@cisco.com

http://www-europe.cisco.com/en/US/docs/voice_ip_comm/csbpipp/ip_phones/release/notes/spa525g_relnote_7_5_1.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1027012

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.