Back to Database
Status published
Medium
CVE-2015-0670
The default configuration of Cisco Small Business IP phones SPA...
Vulnerability Description
The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-0670
Credits & Attribution
No credits recorded in the NVD database.
References
More from cisco
View All →CVE-2025-27091
OpenH264 Decoding Functions Heap Overflow Vulnerability
High
8.6
CVE-2023-25653
Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)
High
7.5
CVE-2021-33478
The TrustZone implementation in certain Broadcom MediaxChange firmware could allow...
Medium
6.8
CVE-2020-16139
A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0...
High
7.5
CVE-2020-16138
A denial-of-service issue in Cisco Unified IP Conference Station 7937G...
High
7.5
Affected Vendor
cisco
View all reports →Affected Software
spa500 firmware, spa 501g 8-line ip phone, spa 502g 1-line ip phone, spa 504g 4-line ip phone, spa 508g 8-line ip phone, spa 509g 12-line ip phone, spa 512g 1-line ip phone, spa 514g 4-line ip phone, spa 525g 5-line ip phone, spa 525g2 5-line ip phone, spa300 firmware, spa 301 1 line ip phone, spa 302d, spa 302dkit, spa 303 3 line ip phone
Vulnerable Versions:
7.5.5
Timeline
Official Publish:
March 21st, 2015
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.