Cisco IP Phones Vulnerable To Remote Eavesdropping

A critical vulnerability in the firmware of Cisco small business phones lets an unauthenticated attacker to remotely eavesdrop on private conversation and make phone calls from vulnerable devices without needing to authenticate, Cisco warned.

LISTEN AND MAKE PHONE CALLS REMOTELY

The vulnerability (CVE-2015-0670) actually resides in the default configuration of certain Cisco IP phones is due to “improper authentication”, which allows hackers to remotely eavesdrop on the affected devices by sending specially crafted XML request.

Moreover, the vulnerability could be exploited by hackers to make phone calls remotely from the vulnerable phones as well as to carry out other attacks by making use of the information gathered through the audio interception activity.

AFFECTED DEVICES

The devices affects the Cisco’s small business _SPA300 _and _SPA500 _Internet Protocol (IP) phones running firmware version 7.5.5, however, Cisco alerts that later versions of these device may also be affected by the flaw.

It’s likely that some phones have been configured to be accessible from the Internet, so it would be very easy for hackers to locate the vulnerable devices that run on vulnerable software versions by using the popular Shodan search engine.

> “To exploit this vulnerability, an attacker may need access to trusted, internal networks behind a firewall to send crafted XML requests to the targeted device,” the Cisco advisory says. “This access requirement may reduce the likelihood of a successful exploit.”

Cisco has confirmed the issue, which was discovered and reported by Chris Watts, a researcher at Tech Analysis in Australia, along with two other flaws – an XSS vulnerability (CVE-2014-3313) and a local code execution vulnerability (CVE-2014-3312).

VULNERABILITY UNPATCHED, YET SOME RECOMMENDATIONS

The company hasn’t patched the problem yet and is working on a new version of the firmware to fix the issue, although the company offers some recommendations in order to mitigate the risk:

• Administrators are advised to enable XML execution authentication in the configuration setting of the affected device.
• Administrators are advised to allow network access only to trusted users.
• Administrators are advised to use Solid firewall strategies to help protect the affected systems from external attacks.
• Administrators may also use IP-based access control lists (ACLs) to allow only trusted systems to access the affected systems.
• Administrators are advised to closely monitor the vulnerable devices.