Tech Analysis research archive
Tech Analysis finds unauthenticated remote dial vulnerability in Cisco SPA300 and SPA500 Series IP phones, CVE-2015-0670
Tech Analysis is no longer trading. This website is maintained as the personal profile and research archive of its founder, Chris Watts, who now works at CyberCX. Earlier research remains attributed to Tech Analysis as originally published.
What was reported
On 19 March 2015 Cisco published an advisory for an authentication weakness in the firmware of its Small Business SPA300 and SPA500 Series IP phones, assigned CVE-2015-0670. In Cisco's words, improper authentication settings in the default configuration could allow an unauthenticated, remote attacker to send a crafted XML request to a phone and listen to its audio stream or make calls from it. Cisco noted that an attacker may need access to trusted internal networks behind a firewall, gave it a CVSS v2 base score of 6.4, confirmed version 7.5.5 as vulnerable, and stated that software updates were not available at the time.
Tech Analysis announced the finding on this page on 22 March 2015. It became the most widely reported of Chris Watts's Cisco findings: iTnews interviewed him on 22 March 2015, and The Register, SecurityWeek, The Hacker News, Tripwire and Security Affairs covered it the following day.
Primary sources
- Cisco: Cisco Small Business SPA300 and SPA500 Series IP Phones Unauthenticated Remote Dial Vulnerability (first published 19 March 2015)
- CVE-2015-0670 on cve.org; CVE-2015-0670 in the National Vulnerability Database
- Archived copy of the original Tech Analysis article (Internet Archive)
- The Register, 23 March 2015: Small biz Cisco phones open to eavesdrop 0-day
Attribution
Cisco's advisory states: "Cisco would like to thank Chris Watts of Tech Analysis for reporting this vulnerability." iTnews (Cisco confirms IP phone eavesdropping flaw, 22 March 2015) quotes him directly.
See the full research index for all public vulnerability records credited to Chris Watts.