CVE-2014-3312: Cisco SPA901 1-Line IP Phone

Medium severity, CVSS 6.9. EPSS: 0.4% chance of exploitation in the next 30 days.

The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435.

Affected products

• Cisco SPA901 1-Line IP Phone: any version
• Cisco SPA922 1-Line IP Phone With 1-Port Ethernet: any version
• Cisco SPA941 4-Line IP Phone With 1-Port Ethernet: any version
• Cisco SPA942 4-Line IP Phone With 2-Port Switch: any version
• Cisco SPA962 6-Line IP Phone With 2-Port Switch: any version
• Cisco Spa 301 1 Line IP Phone: any version
• Cisco Spa 303 3 Line IP Phone: any version
• Cisco Spa 501g 8-Line IP Phone: any version
• Cisco Spa 502g 1-Line IP Phone: any version
• Cisco Spa 504g 4-Line IP Phone: any version
• Cisco Spa 508g 8-Line IP Phone: any version
• Cisco Spa 509g 12-Line IP Phone: any version
• Cisco Spa 512g 1-Line IP Phone: any version
• Cisco Spa 514g 4-Line IP Phone: any version
• Cisco Spa 525g2 5-Line IP Phone: any version
• Cisco Spa 525g 5-Line IP Phone: any version

Published 2014-07-09. Last modified 2026-06-17.