XSS in Cisco Spa2102 Phone Adapter With Router
CVE-2011-2545
Cross-site scripting (XSS) vulnerability in the SIP implementation on the Cisco SPA8000 and SPA8800 before 6.1.11, SPA2102 and SPA3102 before 5.2.13, and SPA 500 series IP phones before 7.4.9 allows remote attackers to inject arbitrary web script or HTML via the FROM field of an INVITE message, aka Bug IDs CSCtr27277, CSCtr27256, CSCtr27274, and CSCtr14715.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.009 (60.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 60.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: -0.000
Affected products
- Cisco Spa2102 Phone Adapter With Router
- Cisco Spa2102 Phone Adapter With Router Firmware — versions 5.2.3, 5.2.5, 5.2.10
- Cisco Spa3102 Voice Gateway With Router
- Cisco Spa3102 Voice Gateway With Router Firmware — versions 3.3.6, 5.1.7
- Cisco Spa 500 Series Ip Phone Firmware — versions 7.3.7, 7.4.3, 7.4.4
- Cisco Spa 501g 8-Line Ip Phone
- Cisco Spa 502g 1-Line Ip Phone
- Cisco Spa 504g 4-Line Ip Phone
- Cisco Spa 508g 8-Line Ip Phone
- Cisco Spa 509g 12-Line Ip Phone
Weakness classification (CWE)
References
- tools.cisco.com/security/center/viewAlert.x (Vendor Advisory)