« Volver al listado

CVE-2014-3312

Estado: ModificadaMedia (6.9)—

The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (16)

Cisco — Spa901 1-line IP PhoneCisco — Spa922 1-line IP Phone With 1-port EthernetCisco — Spa941 4-line IP Phone With 1-port EthernetCisco — Spa942 4-line IP Phone With 2-port SwitchCisco — Spa962 6-line IP Phone With 2-port SwitchCisco — SPA 301 1 Line IP PhoneCisco — SPA 303 3 Line IP PhoneCisco — SPA 501g 8-line IP PhoneCisco — SPA 502g 1-line IP PhoneCisco — SPA 504g 4-line IP PhoneCisco — SPA 508g 8-line IP PhoneCisco — SPA 509g 12-line IP PhoneCisco — SPA 512g 1-line IP PhoneCisco — SPA 514g 4-line IP PhoneCisco — SPA 525g2 5-line IP PhoneCisco — SPA 525g 5-line IP Phone

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-3312",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-07-09T11:07:01.493",
  "references": [
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3312",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/68465",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1030552",
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94421",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3312",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/68465",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1030552",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94421",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435."
    },
    {
      "lang": "es",
      "value": "La interfaz de la consola de depuración en los teléfonos Cisco Small Business SPA300 y SPA500 no realiza debidamente la autenticación, lo que permite a usuarios locales ejecutar comandos del sistema de depuración arbitrarios, o leer o modificar datos en la memoria o un sistema de ficheros, a través del acceso directo a esta interfaz, también conocido como Bug ID CSCun77435."
    }
  ],
  "lastModified": "2026-06-17T00:07:58.147",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:spa_301_1_line_ip_phone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0730B450-BC83-4624-9F0C-4DBDB8EC2270"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa_303_3_line_ip_phone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF3EB07A-B4FB-4649-B8EF-10E642454126"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa_501g_8-line_ip_phone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "527E6A1C-A9AE-4AF3-8507-AC2A03924E7E"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa_502g_1-line_ip_phone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD470FF7-2536-4438-8ABD-96CB2C3E75E5"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa_504g_4-line_ip_phone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84F14F35-FB94-4EC7-B50C-2CA6DD03A703"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa_508g_8-line_ip_phone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FA06FAB-9D59-40AD-8888-767D48B2DBCF"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa_509g_12-line_ip_phone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F797658-737B-445F-AF43-E591231F1A64"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa_512g_1-line_ip_phone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71D77638-F36D-4FE7-871F-DB985DD82130"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa_514g_4-line_ip_phone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A68F5658-F1EE-4AA5-A7E5-4FEAA73C0DA0"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa_525g_5-line_ip_phone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEDD2219-75C0-4E70-9A32-761CAB513C4F"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa_525g2_5-line_ip_phone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6CC94EC7-F454-4FAD-9E40-474A4D416F60"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa901_1-line_ip_phone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96E1F0C7-7BE9-45AA-90F1-FAE8EEC6BD8B"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa922_1-line_ip_phone_with_1-port_ethernet:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA385D00-7BA4-4DFB-8E90-BCE67FCA500E"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa941_4-line_ip_phone_with_1-port_ethernet:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF945607-A3E5-4922-8841-E0893FCC5B18"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa942_4-line_ip_phone_with_2-port_switch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20E21B6C-C0A1-4373-9994-BA708218E741"
            },
            {
              "criteria": "cpe:2.3:h:cisco:spa962_6-line_ip_phone_with_2-port_switch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F518B422-4AFD-49E5-9119-ED4DEEC50C5A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}