CVE:CVE-2015-0670
CNNVD:CNNVD-201503-416
Cisco Small Business IP phones SPA 300和SPA 500是美国思科（Cisco）公司的SPA 300和SPA 500系列IP网络电话产品。
Cisco Small Business IP phones SPA 300 7.5.5版本和SPA 500 7.5.5版本的默认配置中存在安全漏洞，该漏洞源于程序没有正确设置身份验证。远程攻击者可通过发送特制的XML请求利用该漏洞读取audio-stream数据，或获取拨打电话的权限。
solution:Upgrade cisco spa500_firmware to a higher version than 7.5.5,and avoid the version 7.5.5; Upgrade cisco spa_501g_8-line_ip_phone to a higher version than *; Upgrade cisco spa_502g_1-line_ip_phone to a higher version than *; Upgrade cisco spa_504g_4-line_ip_phone to a higher version than *; Upgrade cisco spa_508g_8-line_ip_phone to a higher version than *; Upgrade cisco spa_509g_12-line_ip_phone to a higher version than *; Upgrade cisco spa_512g_1-line_ip_phone to a higher version than *; Upgrade cisco spa_514g_4-line_ip_phone to a higher version than *; Upgrade cisco spa_525g_5-line_ip_phone to a higher version than *; Upgrade cisco spa_525g2_5-line_ip_phone to a higher version than *; Upgrade cisco spa300_firmware to a higher version than 7.5.5,and avoid the version 7.5.5; Upgrade cisco spa_301_1_line_ip_phone to a higher version than *; Upgrade cisco spa_302d to a higher version than *; Upgrade cisco spa_302dkit to a higher version than *; Upgrade cisco spa_303_3_line_ip_phone to a higher version than *