Cisco small business phones open to remote eavesdropping, calling

You don’t need to be the NSA to tap calls on Cisco’s SPA 300 and 500 IP phones: An authentication flaw allows potential attackers to do that by default.

An unpatched vulnerability in the firmware of the SPA 300 and 500 series IP phones, typically used by small businesses, could allow eavesdropping on calls.

“The vulnerability is due to improper authentication settings in the default configuration,” Cisco Systems said in a security advisory.

Unauthenticated remote attackers could send crafted XML requests to affected devices in order to exploit the flaw and remotely listen to audio streams or make phone calls through them, the company warned.

To read this article in full or to leave a comment, please click here

Read more: Cisco small business phones open to remote eavesdropping, calling

Story added 23. March 2015, content source with full text you can find at link above.