CVE-2014-3312

Published: Jul 9, 2014Modified: May 6, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435.

Affected (16)

Cisco

16 products

Spa901 1 Line Ip Phone

Spa922 1 Line Ip Phone With 1 Port Ethernet

Spa941 4 Line Ip Phone With 1 Port Ethernet

Spa942 4 Line Ip Phone With 2 Port Switch

Spa962 6 Line Ip Phone With 2 Port Switch

Spa 301 1 Line Ip Phone

Spa 303 3 Line Ip Phone

Spa 501g 8 Line Ip Phone

Spa 502g 1 Line Ip Phone

Spa 504g 4 Line Ip Phone

Spa 508g 8 Line Ip Phone

Spa 509g 12 Line Ip Phone

Spa 512g 1 Line Ip Phone

Spa 514g 4 Line Ip Phone

Spa 525g2 5 Line Ip Phone

Spa 525g 5 Line Ip Phone

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Cisco Spa901 1 Line Ip Phone	All versions
Cisco Spa922 1 Line Ip Phone With 1 Port Ethernet	All versions
Cisco Spa941 4 Line Ip Phone With 1 Port Ethernet	All versions
Cisco Spa942 4 Line Ip Phone With 2 Port Switch	All versions
Cisco Spa962 6 Line Ip Phone With 2 Port Switch	All versions
Cisco Spa 301 1 Line Ip Phone	All versions
Cisco Spa 303 3 Line Ip Phone	All versions
Cisco Spa 501g 8 Line Ip Phone	All versions
Cisco Spa 502g 1 Line Ip Phone	All versions
Cisco Spa 504g 4 Line Ip Phone	All versions
Cisco Spa 508g 8 Line Ip Phone	All versions
Cisco Spa 509g 12 Line Ip Phone	All versions
Cisco Spa 512g 1 Line Ip Phone	All versions
Cisco Spa 514g 4 Line Ip Phone	All versions
Cisco Spa 525g2 5 Line Ip Phone	All versions
Cisco Spa 525g 5 Line Ip Phone	All versions