Lucene search
CiscoCVE-2015-6403HistoryDec 15, 2015 - 5:59 a.m.
CVE-2015-6403
2015-12-1505:59:04
CWE-20
cisco
web.nvd.nist.gov
26
cve-2015-6403
tftp
cisco
small business
spa30x
spa50x
spa51x
firmware-image
integrity
shell access
trojan horse
bug id cscut67400
nvd
CVSS2
7.2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
AI Score
6.4
Confidence
Low
EPSS
0
Percentile
5.1%
The TFTP implementation on Cisco Small Business SPA30x, SPA50x, SPA51x phones 7.5.7 improperly validates firmware-image file integrity, which allows local users to load a Trojan horse image by leveraging shell access, aka Bug ID CSCut67400.
Affected configurations
Node
ciscospa500_firmwareMatch7.5.7
ciscospa_500dsMatch-
ORciscospa_500sMatch-
ORciscospa_501gMatch-
ORciscospa_502gMatch-
ORciscospa_504gMatch-
ORciscospa_508gMatch-
ORciscospa_509gMatch-
ORciscospa_512gMatch-
ORciscospa_514gMatch-
ORciscospa_525g2Match-
Node
ciscospa300_firmwareMatch7.5.7
ciscospa_301Match-
ORciscospa_303Match-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| cisco | spa500_firmware | 7.5.7 | cpe:2.3:o:cisco:spa500_firmware:7.5.7:*:*:*:*:*:*:* |
| cisco | spa_500ds | - | cpe:2.3:h:cisco:spa_500ds:-:*:*:*:*:*:*:* |
| cisco | spa_500s | - | cpe:2.3:h:cisco:spa_500s:-:*:*:*:*:*:*:* |
| cisco | spa_501g | - | cpe:2.3:h:cisco:spa_501g:-:*:*:*:*:*:*:* |
| cisco | spa_502g | - | cpe:2.3:h:cisco:spa_502g:-:*:*:*:*:*:*:* |
| cisco | spa_504g | - | cpe:2.3:h:cisco:spa_504g:-:*:*:*:*:*:*:* |
| cisco | spa_508g | - | cpe:2.3:h:cisco:spa_508g:-:*:*:*:*:*:*:* |
| cisco | spa_509g | - | cpe:2.3:h:cisco:spa_509g:-:*:*:*:*:*:*:* |
| cisco | spa_512g | - | cpe:2.3:h:cisco:spa_512g:-:*:*:*:*:*:*:* |
| cisco | spa_514g | - | cpe:2.3:h:cisco:spa_514g:-:*:*:*:*:*:*:* |
Related
nvd
nvd
CVE-2015-6403
2015-12-15 05:59:04
cvelist
cvelist
CVE-2015-6403
2015-12-15 02:00:00
prion
prion
Information disclosure
2015-12-15 05:59:00
cisco
cisco
Multiple Cisco IP Phones Firmware Image Upload Vulnerability
2015-12-09 00:00:00
CVSS2
7.2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
AI Score
6.4
Confidence
Low
EPSS
0
Percentile
5.1%
Related for CVE-2015-6403