All the vulnerabilites related to cisco - spa_525g_firmware
cve-2024-20451
Vulnerability from cvelistv5
Published
2024-08-07 16:48
Modified
2024-08-07 17:24
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly.
These vulnerabilities exist because HTTP packets are not properly checked for errors. An attacker could exploit this vulnerability by sending a crafted HTTP packet to the remote interface of an affected device. A successful exploit could allow the attacker to cause a DoS condition on the device.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco Small Business IP Phones |
Version: 7.6.0 Version: 7.6.2 Version: 7.6.2SR3 Version: 7.6.2SR6 Version: 7.6.2SR2 Version: 7.6.2SR4 Version: 7.6.2SR1 Version: 7.6.2SR5 Version: 7.6.2SR7 Version: 7.6.1 Version: 7.3.7 Version: 7.5.5 Version: 7.5.6(XU) Version: 7.5.2 Version: 7.5.2a Version: 7.5.7 Version: 7.5.3 Version: 7.5.6 Version: 7.5.2b Version: 7.5.6c Version: 7.5.6a Version: 7.5.7s Version: 7.5.1 Version: 7.5.5a Version: 7.5.5b Version: 7.5.4 Version: 7.4.7 Version: 7.4.4 Version: 7.4.8 Version: 7.4.3 Version: 7.4.9 Version: 7.4.6 Version: 1.0.17 |
|
|
|||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T17:23:48.503152Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T17:24:11.420Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco Small Business IP Phones",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.6.2SR3"
},
{
"status": "affected",
"version": "7.6.2SR6"
},
{
"status": "affected",
"version": "7.6.2SR2"
},
{
"status": "affected",
"version": "7.6.2SR4"
},
{
"status": "affected",
"version": "7.6.2SR1"
},
{
"status": "affected",
"version": "7.6.2SR5"
},
{
"status": "affected",
"version": "7.6.2SR7"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.3.7"
},
{
"status": "affected",
"version": "7.5.5"
},
{
"status": "affected",
"version": "7.5.6(XU)"
},
{
"status": "affected",
"version": "7.5.2"
},
{
"status": "affected",
"version": "7.5.2a"
},
{
"status": "affected",
"version": "7.5.7"
},
{
"status": "affected",
"version": "7.5.3"
},
{
"status": "affected",
"version": "7.5.6"
},
{
"status": "affected",
"version": "7.5.2b"
},
{
"status": "affected",
"version": "7.5.6c"
},
{
"status": "affected",
"version": "7.5.6a"
},
{
"status": "affected",
"version": "7.5.7s"
},
{
"status": "affected",
"version": "7.5.1"
},
{
"status": "affected",
"version": "7.5.5a"
},
{
"status": "affected",
"version": "7.5.5b"
},
{
"status": "affected",
"version": "7.5.4"
},
{
"status": "affected",
"version": "7.4.7"
},
{
"status": "affected",
"version": "7.4.4"
},
{
"status": "affected",
"version": "7.4.8"
},
{
"status": "affected",
"version": "7.4.3"
},
{
"status": "affected",
"version": "7.4.9"
},
{
"status": "affected",
"version": "7.4.6"
},
{
"status": "affected",
"version": "1.0.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly.\r\n\r\nThese vulnerabilities exist because HTTP packets are not properly checked for errors. An attacker could exploit this vulnerability by sending a crafted HTTP packet to the remote interface of an affected device. A successful exploit could allow the attacker to cause a DoS condition on the device."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T16:48:57.555Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-spa-http-vulns-RJZmX2Xz",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-http-vulns-RJZmX2Xz"
}
],
"source": {
"advisory": "cisco-sa-spa-http-vulns-RJZmX2Xz",
"defects": [
"CSCwk31988"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20451",
"datePublished": "2024-08-07T16:48:37.184Z",
"dateReserved": "2023-11-08T15:08:07.679Z",
"dateUpdated": "2024-08-07T17:24:11.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-20450
Vulnerability from cvelistv5
Published
2024-08-07 16:46
Modified
2024-08-22 15:31
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges.
These vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco Small Business IP Phones |
Version: 7.6.0 Version: 7.6.2 Version: 7.6.2SR3 Version: 7.6.2SR6 Version: 7.6.2SR2 Version: 7.6.2SR4 Version: 7.6.2SR1 Version: 7.6.2SR5 Version: 7.6.2SR7 Version: 7.6.1 Version: 7.3.7 Version: 7.5.5 Version: 7.5.6(XU) Version: 7.5.2 Version: 7.5.2a Version: 7.5.7 Version: 7.5.3 Version: 7.5.6 Version: 7.5.2b Version: 7.5.6c Version: 7.5.6a Version: 7.5.7s Version: 7.5.1 Version: 7.5.5a Version: 7.5.5b Version: 7.5.4 Version: 7.4.7 Version: 7.4.4 Version: 7.4.8 Version: 7.4.3 Version: 7.4.9 Version: 7.4.6 Version: 1.0.17 |
|
|
|||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cisco:small_business_ip_phone_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "small_business_ip_phone_firmware",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.6.2sr3"
},
{
"status": "affected",
"version": "7.6.2sr6"
},
{
"status": "affected",
"version": "7.6.2sr2"
},
{
"status": "affected",
"version": "7.6.2sr4"
},
{
"status": "affected",
"version": "7.6.2sr1"
},
{
"status": "affected",
"version": "7.6.2sr5"
},
{
"status": "affected",
"version": "7.6.2sr7"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.3.7"
},
{
"status": "affected",
"version": "7.5.5"
},
{
"status": "affected",
"version": "7.5.6xu"
},
{
"status": "affected",
"version": "7.5.2"
},
{
"status": "affected",
"version": "7.5.2a"
},
{
"status": "affected",
"version": "7.5.7"
},
{
"status": "affected",
"version": "7.5.3"
},
{
"status": "affected",
"version": "7.5.6"
},
{
"status": "affected",
"version": "7.5.2b"
},
{
"status": "affected",
"version": "7.5.6a"
},
{
"status": "affected",
"version": "7.5.7s"
},
{
"status": "affected",
"version": "7.5.1"
},
{
"status": "affected",
"version": "7.5.5a"
},
{
"status": "affected",
"version": "7.5.5b"
},
{
"status": "affected",
"version": "7.5.4"
},
{
"status": "affected",
"version": "7.4.7"
},
{
"status": "affected",
"version": "7.4.4"
},
{
"status": "affected",
"version": "7.4.8"
},
{
"status": "affected",
"version": "7.4.3"
},
{
"status": "affected",
"version": "7.4.9"
},
{
"status": "affected",
"version": "7.4.6"
},
{
"status": "affected",
"version": "1.0.17"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-08T03:55:26.731322Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T15:31:24.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco Small Business IP Phones",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.6.2SR3"
},
{
"status": "affected",
"version": "7.6.2SR6"
},
{
"status": "affected",
"version": "7.6.2SR2"
},
{
"status": "affected",
"version": "7.6.2SR4"
},
{
"status": "affected",
"version": "7.6.2SR1"
},
{
"status": "affected",
"version": "7.6.2SR5"
},
{
"status": "affected",
"version": "7.6.2SR7"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.3.7"
},
{
"status": "affected",
"version": "7.5.5"
},
{
"status": "affected",
"version": "7.5.6(XU)"
},
{
"status": "affected",
"version": "7.5.2"
},
{
"status": "affected",
"version": "7.5.2a"
},
{
"status": "affected",
"version": "7.5.7"
},
{
"status": "affected",
"version": "7.5.3"
},
{
"status": "affected",
"version": "7.5.6"
},
{
"status": "affected",
"version": "7.5.2b"
},
{
"status": "affected",
"version": "7.5.6c"
},
{
"status": "affected",
"version": "7.5.6a"
},
{
"status": "affected",
"version": "7.5.7s"
},
{
"status": "affected",
"version": "7.5.1"
},
{
"status": "affected",
"version": "7.5.5a"
},
{
"status": "affected",
"version": "7.5.5b"
},
{
"status": "affected",
"version": "7.5.4"
},
{
"status": "affected",
"version": "7.4.7"
},
{
"status": "affected",
"version": "7.4.4"
},
{
"status": "affected",
"version": "7.4.8"
},
{
"status": "affected",
"version": "7.4.3"
},
{
"status": "affected",
"version": "7.4.9"
},
{
"status": "affected",
"version": "7.4.6"
},
{
"status": "affected",
"version": "1.0.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges.\r\n\r\nThese vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T16:47:11.963Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-spa-http-vulns-RJZmX2Xz",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-http-vulns-RJZmX2Xz"
}
],
"source": {
"advisory": "cisco-sa-spa-http-vulns-RJZmX2Xz",
"defects": [
"CSCwk31988"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20450",
"datePublished": "2024-08-07T16:46:42.633Z",
"dateReserved": "2023-11-08T15:08:07.678Z",
"dateUpdated": "2024-08-22T15:31:24.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-20454
Vulnerability from cvelistv5
Published
2024-08-07 16:47
Modified
2024-08-25 15:47
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges.
These vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco Small Business IP Phones |
Version: 7.6.0 Version: 7.6.2 Version: 7.6.2SR3 Version: 7.6.2SR6 Version: 7.6.2SR2 Version: 7.6.2SR4 Version: 7.6.2SR1 Version: 7.6.2SR5 Version: 7.6.2SR7 Version: 7.6.1 Version: 7.3.7 Version: 7.5.5 Version: 7.5.6(XU) Version: 7.5.2 Version: 7.5.2a Version: 7.5.7 Version: 7.5.3 Version: 7.5.6 Version: 7.5.2b Version: 7.5.6c Version: 7.5.6a Version: 7.5.7s Version: 7.5.1 Version: 7.5.5a Version: 7.5.5b Version: 7.5.4 Version: 7.4.7 Version: 7.4.4 Version: 7.4.8 Version: 7.4.3 Version: 7.4.9 Version: 7.4.6 Version: 1.0.17 |
|
|
|||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20454",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-08T03:55:28.982035Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-25T15:47:07.213Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco Small Business IP Phones",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.6.2SR3"
},
{
"status": "affected",
"version": "7.6.2SR6"
},
{
"status": "affected",
"version": "7.6.2SR2"
},
{
"status": "affected",
"version": "7.6.2SR4"
},
{
"status": "affected",
"version": "7.6.2SR1"
},
{
"status": "affected",
"version": "7.6.2SR5"
},
{
"status": "affected",
"version": "7.6.2SR7"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.3.7"
},
{
"status": "affected",
"version": "7.5.5"
},
{
"status": "affected",
"version": "7.5.6(XU)"
},
{
"status": "affected",
"version": "7.5.2"
},
{
"status": "affected",
"version": "7.5.2a"
},
{
"status": "affected",
"version": "7.5.7"
},
{
"status": "affected",
"version": "7.5.3"
},
{
"status": "affected",
"version": "7.5.6"
},
{
"status": "affected",
"version": "7.5.2b"
},
{
"status": "affected",
"version": "7.5.6c"
},
{
"status": "affected",
"version": "7.5.6a"
},
{
"status": "affected",
"version": "7.5.7s"
},
{
"status": "affected",
"version": "7.5.1"
},
{
"status": "affected",
"version": "7.5.5a"
},
{
"status": "affected",
"version": "7.5.5b"
},
{
"status": "affected",
"version": "7.5.4"
},
{
"status": "affected",
"version": "7.4.7"
},
{
"status": "affected",
"version": "7.4.4"
},
{
"status": "affected",
"version": "7.4.8"
},
{
"status": "affected",
"version": "7.4.3"
},
{
"status": "affected",
"version": "7.4.9"
},
{
"status": "affected",
"version": "7.4.6"
},
{
"status": "affected",
"version": "1.0.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges.\r\n\r\nThese vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T16:47:46.205Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-spa-http-vulns-RJZmX2Xz",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-http-vulns-RJZmX2Xz"
}
],
"source": {
"advisory": "cisco-sa-spa-http-vulns-RJZmX2Xz",
"defects": [
"CSCwk31988"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20454",
"datePublished": "2024-08-07T16:47:46.205Z",
"dateReserved": "2023-11-08T15:08:07.679Z",
"dateUpdated": "2024-08-25T15:47:07.213Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-12260
Vulnerability from cvelistv5
Published
2017-10-19 08:00
Modified
2024-08-05 18:28
Severity ?
EPSS score ?
Summary
A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this vulnerability by using formatted specifiers in a SIP payload that is sent to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. This vulnerability affects Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones that are running firmware release 7.6.2SR1 or earlier. Cisco Bug IDs: CSCvc63986.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/101495 | vdb-entry, x_refsource_BID | |
| http://www.securitytracker.com/id/1039616 | vdb-entry, x_refsource_SECTRACK | |
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | n/a | Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones |
Version: Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T18:28:16.705Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "101495",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/101495"
},
{
"name": "1039616",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1039616"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones"
}
]
}
],
"datePublic": "2017-10-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this vulnerability by using formatted specifiers in a SIP payload that is sent to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. This vulnerability affects Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones that are running firmware release 7.6.2SR1 or earlier. Cisco Bug IDs: CSCvc63986."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-10-20T09:57:01",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "101495",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/101495"
},
{
"name": "1039616",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1039616"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"ID": "CVE-2017-12260",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones",
"version": {
"version_data": [
{
"version_value": "Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this vulnerability by using formatted specifiers in a SIP payload that is sent to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. This vulnerability affects Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones that are running firmware release 7.6.2SR1 or earlier. Cisco Bug IDs: CSCvc63986."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "101495",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101495"
},
{
"name": "1039616",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1039616"
},
{
"name": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1",
"refsource": "CONFIRM",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2017-12260",
"datePublished": "2017-10-19T08:00:00",
"dateReserved": "2017-08-03T00:00:00",
"dateUpdated": "2024-08-05T18:28:16.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2024-08-07 17:15
Modified
2024-08-23 18:14
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges.
These vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_301_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "697C8BBB-B1F4-4A5C-A070-48A3B15D191B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_301_1_line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EDF1A0FF-C0C1-4D74-BEF5-45A7AB770A64",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_303_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F2EFA253-DE1A-471C-926B-0AED23CEAE3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_303_3_line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B96F5E5F-1917-4D99-8A93-569BE4A04E20",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_501g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "45F07D08-E03B-4A90-85A7-D4279AAB3511",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_501g_8-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6C8A2149-0224-468F-A8B2-EE7B958544E0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_502g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1DE94BF-003A-4E4D-8DEC-B2424DDD315A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_502g_1-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89E82EB4-8272-4660-9FEB-ED0751AAF7D4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_504g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0FECDC17-06B4-45FA-A5DB-E4F8D6A7A98C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_504g_4-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "526D3186-83F0-4001-8643-2AFE18C65740",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_508g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AC0B806A-DE74-41F1-9C67-696F6B5C49B2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_508g_8-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "26711CC8-5B99-4CFA-8C1B-62CA4ABBE828",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_509g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A016EA95-FD42-45A2-B219-523F5B153020",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_509g_12-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0CCDEBE5-EBD7-4C62-AFAD-DB716412F0C3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_512g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "74DD7845-D19C-401D-B029-967FFE911BDD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_512g_1-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2ABA7665-EF17-4B62-8415-B2DC0CFA92BD",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_514g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1C144A2E-9E18-4274-91E3-B08F3B68C120",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_514g_4-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2B7B70D-5054-4857-A0D4-54244E27F506",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_525g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0DE79788-8729-4B6F-A1B7-6FB14680CA90",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_525g_5-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AFF07D3E-5441-48C3-9E04-78BC722D535A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_525g2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CC4E91E7-1208-43EC-8239-C243C2BD976A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_525g2_5-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "516C7E78-E23B-4ECD-8FB6-EADF9D0E40C7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges.\r\n\r\nThese vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en la interfaz de administraci\u00f3n basada en web de los tel\u00e9fonos IP Cisco Small Business serie SPA300 y los tel\u00e9fonos IP Cisco Small Business serie SPA500 podr\u00edan permitir que un atacante remoto no autenticado ejecute comandos arbitrarios en el sistema operativo subyacente con privilegios de superusuario. Estas vulnerabilidades existen porque los paquetes HTTP entrantes no se verifican adecuadamente en busca de errores, lo que podr\u00eda provocar un desbordamiento del b\u00fafer. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando una solicitud HTTP dise\u00f1ada a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante desbordar un b\u00fafer interno y ejecutar comandos arbitrarios en el nivel de privilegio superusuario."
}
],
"id": "CVE-2024-20450",
"lastModified": "2024-08-23T18:14:43.787",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-08-07T17:15:50.283",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-http-vulns-RJZmX2Xz"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-10-19 08:29
Modified
2024-11-21 03:09
Severity ?
Summary
A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this vulnerability by using formatted specifiers in a SIP payload that is sent to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. This vulnerability affects Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones that are running firmware release 7.6.2SR1 or earlier. Cisco Bug IDs: CSCvc63986.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| ykramarz@cisco.com | http://www.securityfocus.com/bid/101495 | Third Party Advisory, VDB Entry | |
| ykramarz@cisco.com | http://www.securitytracker.com/id/1039616 | Third Party Advisory, VDB Entry | |
| ykramarz@cisco.com | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/101495 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1039616 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | spa_501g_firmware | * | |
| cisco | spa_501g | - | |
| cisco | spa_502g_firmware | * | |
| cisco | spa_502g | - | |
| cisco | spa_504g_firmware | * | |
| cisco | spa_504g | - | |
| cisco | spa_508g_firmware | * | |
| cisco | spa_508g | - | |
| cisco | spa_509g_firmware | * | |
| cisco | spa_509g | - | |
| cisco | spa_512g_firmware | * | |
| cisco | spa_512g | - | |
| cisco | spa_514g_firmware | * | |
| cisco | spa_514g | - | |
| cisco | spa_525g_firmware | * | |
| cisco | spa_525g | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_501g_firmware:*:sr1:*:*:*:*:*:*",
"matchCriteriaId": "3BDD5305-DBCE-44E2-8246-C45C9AF04A88",
"versionEndIncluding": "7.6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_501g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9A258316-4DB6-47AC-90C0-CB9EF777E151",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_502g_firmware:*:sr1:*:*:*:*:*:*",
"matchCriteriaId": "B4B42E9A-3803-4359-8736-8629169F35F5",
"versionEndIncluding": "7.6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_502g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D5DF893E-7E9E-419B-8E7C-E846333646BA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_504g_firmware:*:sr1:*:*:*:*:*:*",
"matchCriteriaId": "2287FB05-3FDD-4B80-8537-67F80B851119",
"versionEndIncluding": "7.6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_504g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4F78AAB2-8ECD-4FAA-8A2A-9035F5C59597",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_508g_firmware:*:sr1:*:*:*:*:*:*",
"matchCriteriaId": "B6EE4CB0-E332-4261-B92A-F8DB1E571AA9",
"versionEndIncluding": "7.6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_508g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1B26A21E-CD32-4DED-8A31-4CCA1C4DD642",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_509g_firmware:*:sr1:*:*:*:*:*:*",
"matchCriteriaId": "241D9468-FB18-4E5F-B55C-04C4D2554E16",
"versionEndIncluding": "7.6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_509g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2A4373DD-753A-46A6-BB96-0488EA52157E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_512g_firmware:*:sr1:*:*:*:*:*:*",
"matchCriteriaId": "B955A49C-EB75-428C-A7CC-AC58604B635B",
"versionEndIncluding": "7.6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_512g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2CBA0C4D-4BB6-455D-8355-F4FACC5D721C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_514g_firmware:*:sr1:*:*:*:*:*:*",
"matchCriteriaId": "95DF4D27-49DC-4F57-9E3D-E28E5D23AFA0",
"versionEndIncluding": "7.6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_514g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "97551DEA-85F9-4A38-A8AC-F477CB7ABC2C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_525g_firmware:*:sr1:*:*:*:*:*:*",
"matchCriteriaId": "B726AAE8-6556-48D9-ACB7-83538F9FE653",
"versionEndIncluding": "7.6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_525g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "ADAD4489-26BB-4FF4-8D7A-0805CFDD0F31",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this vulnerability by using formatted specifiers in a SIP payload that is sent to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. This vulnerability affects Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones that are running firmware release 7.6.2SR1 or earlier. Cisco Bug IDs: CSCvc63986."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la implementaci\u00f3n de la funcionalidad Session Initiation Protocol (SIP) en Cisco Small Business SPA50x, SPA51x y SPA52x Series IP Phones podr\u00eda permitir que un atacante remoto sin autenticar haga que el dispositivo afectado no responda, lo que da como resultado una condici\u00f3n de denegaci\u00f3n de servicio (DoS). Esta vulnerabilidad se debe a un manejo incorrecto de los mensajes de petici\u00f3n SIP por parte de un dispositivo afectado. Un atacante podr\u00eda explotar esta vulnerabilidad utilizando especificadores formateados en un payload SIP que se env\u00edan a un dispositivo afectado. Un exploit con \u00e9xito, podr\u00eda permitir que el atacante consiga que el dispositivo afectado no responda, lo que da como resultado una condici\u00f3n de DoS que persista hasta que el dispositivo se reinicie manualmente. Esta vulnerabilidad afecta a Cisco Small Business SPA50x, SPA51x, y SPA52x Series IP Phones que ejecutan la distribuci\u00f3n de firmware 7.6.2SR1 o anterior. Cisco Bug IDs: CSCvc63986."
}
],
"id": "CVE-2017-12260",
"lastModified": "2024-11-21T03:09:11.170",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-10-19T08:29:00.310",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/101495"
},
{
"source": "ykramarz@cisco.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1039616"
},
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/101495"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1039616"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-08-07 17:15
Modified
2024-08-23 18:14
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly.
These vulnerabilities exist because HTTP packets are not properly checked for errors. An attacker could exploit this vulnerability by sending a crafted HTTP packet to the remote interface of an affected device. A successful exploit could allow the attacker to cause a DoS condition on the device.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_301_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "697C8BBB-B1F4-4A5C-A070-48A3B15D191B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_301_1_line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EDF1A0FF-C0C1-4D74-BEF5-45A7AB770A64",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_303_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F2EFA253-DE1A-471C-926B-0AED23CEAE3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_303_3_line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B96F5E5F-1917-4D99-8A93-569BE4A04E20",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_501g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "45F07D08-E03B-4A90-85A7-D4279AAB3511",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_501g_8-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6C8A2149-0224-468F-A8B2-EE7B958544E0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_502g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1DE94BF-003A-4E4D-8DEC-B2424DDD315A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_502g_1-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89E82EB4-8272-4660-9FEB-ED0751AAF7D4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_504g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0FECDC17-06B4-45FA-A5DB-E4F8D6A7A98C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_504g_4-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "526D3186-83F0-4001-8643-2AFE18C65740",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_508g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AC0B806A-DE74-41F1-9C67-696F6B5C49B2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_508g_8-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "26711CC8-5B99-4CFA-8C1B-62CA4ABBE828",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_509g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A016EA95-FD42-45A2-B219-523F5B153020",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_509g_12-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0CCDEBE5-EBD7-4C62-AFAD-DB716412F0C3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_512g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "74DD7845-D19C-401D-B029-967FFE911BDD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_512g_1-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2ABA7665-EF17-4B62-8415-B2DC0CFA92BD",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_514g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1C144A2E-9E18-4274-91E3-B08F3B68C120",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_514g_4-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2B7B70D-5054-4857-A0D4-54244E27F506",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_525g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0DE79788-8729-4B6F-A1B7-6FB14680CA90",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_525g_5-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AFF07D3E-5441-48C3-9E04-78BC722D535A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_525g2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CC4E91E7-1208-43EC-8239-C243C2BD976A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_525g2_5-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "516C7E78-E23B-4ECD-8FB6-EADF9D0E40C7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly.\r\n\r\nThese vulnerabilities exist because HTTP packets are not properly checked for errors. An attacker could exploit this vulnerability by sending a crafted HTTP packet to the remote interface of an affected device. A successful exploit could allow the attacker to cause a DoS condition on the device."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en la interfaz de administraci\u00f3n basada en web de los tel\u00e9fonos IP Cisco Small Business serie SPA300 y los tel\u00e9fonos IP Cisco Small Business serie SPA500 podr\u00edan permitir que un atacante remoto no autenticado provoque que un dispositivo afectado se recargue inesperadamente. Estas vulnerabilidades existen porque los paquetes HTTP no se verifican adecuadamente en busca de errores. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando un paquete HTTP manipulado a la interfaz remota de un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante provocar una condici\u00f3n DoS en el dispositivo."
}
],
"id": "CVE-2024-20451",
"lastModified": "2024-08-23T18:14:11.137",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-08-07T17:15:50.493",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-http-vulns-RJZmX2Xz"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-08-07 17:15
Modified
2024-08-23 18:13
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges.
These vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_301_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "697C8BBB-B1F4-4A5C-A070-48A3B15D191B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_301_1_line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EDF1A0FF-C0C1-4D74-BEF5-45A7AB770A64",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_303_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F2EFA253-DE1A-471C-926B-0AED23CEAE3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_303_3_line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B96F5E5F-1917-4D99-8A93-569BE4A04E20",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_501g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "45F07D08-E03B-4A90-85A7-D4279AAB3511",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_501g_8-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6C8A2149-0224-468F-A8B2-EE7B958544E0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_502g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1DE94BF-003A-4E4D-8DEC-B2424DDD315A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_502g_1-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89E82EB4-8272-4660-9FEB-ED0751AAF7D4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_504g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0FECDC17-06B4-45FA-A5DB-E4F8D6A7A98C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_504g_4-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "526D3186-83F0-4001-8643-2AFE18C65740",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_508g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AC0B806A-DE74-41F1-9C67-696F6B5C49B2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_508g_8-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "26711CC8-5B99-4CFA-8C1B-62CA4ABBE828",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_509g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A016EA95-FD42-45A2-B219-523F5B153020",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_509g_12-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0CCDEBE5-EBD7-4C62-AFAD-DB716412F0C3",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_512g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "74DD7845-D19C-401D-B029-967FFE911BDD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_512g_1-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2ABA7665-EF17-4B62-8415-B2DC0CFA92BD",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_514g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1C144A2E-9E18-4274-91E3-B08F3B68C120",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_514g_4-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2B7B70D-5054-4857-A0D4-54244E27F506",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_525g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0DE79788-8729-4B6F-A1B7-6FB14680CA90",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_525g_5-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AFF07D3E-5441-48C3-9E04-78BC722D535A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:spa_525g2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CC4E91E7-1208-43EC-8239-C243C2BD976A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:spa_525g2_5-line_ip_phone:-:*:*:*:*:*:*:*",
"matchCriteriaId": "516C7E78-E23B-4ECD-8FB6-EADF9D0E40C7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges.\r\n\r\nThese vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades en la interfaz de administraci\u00f3n basada en web de los tel\u00e9fonos IP Cisco Small Business serie SPA300 y los tel\u00e9fonos IP Cisco Small Business serie SPA500 podr\u00edan permitir que un atacante remoto no autenticado ejecute comandos arbitrarios en el sistema operativo subyacente con privilegios de superusuario. Estas vulnerabilidades existen porque los paquetes HTTP entrantes no se verifican adecuadamente en busca de errores, lo que podr\u00eda provocar un desbordamiento del b\u00fafer. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando una solicitud HTTP manipulada a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante desbordar un b\u00fafer interno y ejecutar comandos arbitrarios en el nivel de privilegio superusuario."
}
],
"id": "CVE-2024-20454",
"lastModified": "2024-08-23T18:13:47.510",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-08-07T17:15:50.713",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-http-vulns-RJZmX2Xz"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}