XSS in Cisco Spa_301_1_line_ip_phone
CVE-2014-3313
Cross-site scripting (XSS) vulnerability in the web user interface on Cisco Small Business SPA300 and SPA500 phones allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuo52582.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.020 (78.0th percentile) — read the EPSS interpretation.
Affected products
- Cisco Spa_301_1_line_ip_phone
- Cisco Spa_303_3_line_ip_phone
- Cisco Spa_501g_8-line_ip_phone
- Cisco Spa_502g_1-line_ip_phone
- Cisco Spa_504g_4-line_ip_phone
- Cisco Spa_508g_8-line_ip_phone
- Cisco Spa_509g_12-line_ip_phone
- Cisco Spa_512g_1-line_ip_phone
- Cisco Spa_514g_4-line_ip_phone
- Cisco Spa_525g2_5-line_ip_phone
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)
- psirt@cisco.com (vdb-entry, x_refsource_BID)
- psirt@cisco.com (vdb-entry, x_refsource_XF)
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (x_refsource_SECUNIA, third-party-advisory)