Cross-site request forgery in Small Business SPA300 and Small Business SPA500 - CVE-2017-12271
Published: October 19, 2017
Vulnerability identifier: #VU8893
CSH Severity: Low
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12271
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to perform CSRF attack.
The weakness exists in Cisco SPA300/SPA500 Series IP Phones due to a lack of cross-site request forgery (CSRF) protection. A remote attacker can create a specially crafted HTML page or URL, trick the victim into visiting it, gain access to the system and perform arbitrary actions.
The weakness exists in Cisco SPA300/SPA500 Series IP Phones due to a lack of cross-site request forgery (CSRF) protection. A remote attacker can create a specially crafted HTML page or URL, trick the victim into visiting it, gain access to the system and perform arbitrary actions.
Affected software
Small Business SPA300
Small Business SPA500
Small Business SPA500
How to mitigate CVE-2017-12271
Update to version 7.6(2)SR3.