Tech Analysis research archive
Tech Analysis finds remote Cisco IP phone cross-site scripting vulnerability, CVE-2014-3313
Tech Analysis is no longer trading. This website is maintained as the personal profile and research archive of its founder, Chris Watts, who now works at CyberCX. Earlier research remains attributed to Tech Analysis as originally published.
What was reported
On 9 July 2014 Cisco published a security notice for a cross-site scripting (XSS) vulnerability in the web user interface of its Small Business SPA300 and SPA500 Series IP phones, assigned CVE-2014-3313. In Cisco's words, insufficient validation of user-supplied input could allow an unauthenticated, remote attacker to execute a cross-site scripting attack by persuading a user to click a crafted URL. SPA500 Series firmware 7.5(.4) and prior and SPA300 Series firmware 7.5(.5) and prior were listed as affected, and Cisco gave it a CVSS v2 base score of 4.3.
Tech Analysis announced the finding on this page on 21 July 2014 as a vulnerability found by Chris Watts of Tech Analysis, reproducing Cisco's summary and linking to the Cisco notice, the National Vulnerability Database entry and AusCERT bulletin ESB-2014.1151. The same day Cisco had also published a notice for a separate local debug-shell weakness in the same phones (CVE-2014-3312). In March 2015 a third phone issue reported by Chris, an unauthenticated remote dial and audio-stream vulnerability (CVE-2015-0670), drew wide reporting, and The Register and Tripwire linked to this page when describing the earlier findings.
Primary sources
- Cisco: Cisco Small Business SPA300 and SPA500 Series IP Phones Cross-Site Scripting Vulnerability (first published 9 July 2014)
- CVE-2014-3313 on cve.org; CVE-2014-3313 in the National Vulnerability Database
- Archived copy of the original Tech Analysis article (Internet Archive)
- Cisco: SPA300 and SPA500 Series IP Phones Local Code Execution Vulnerability (CVE-2014-3312), published the same day
- The Register, 23 March 2015: Small biz Cisco phones open to eavesdrop 0-day (links to this page)
- Tripwire, 23 March 2015: Vulnerability in Cisco IP Phones Allows Attackers to Remotely Eavesdrop on Audio Streams (links to this page)
Attribution
Cisco's currently published notice for CVE-2014-3313 does not display a researcher credit. Attribution to Chris Watts of Tech Analysis is supported by the original Tech Analysis announcement preserved by the Internet Archive and by iTnews (Cisco confirms IP phone eavesdropping flaw, 22 March 2015), which quotes him and names all three phone vulnerabilities.
See the full research index for all public vulnerability records credited to Chris Watts.