CVE-2014-3313: Cisco SPA901 1-Line IP Phone

Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the web user interface on Cisco Small Business SPA300 and SPA500 phones allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuo52582.

Affected products

• Cisco SPA901 1-Line IP Phone: any version
• Cisco SPA922 1-Line IP Phone With 1-Port Ethernet: any version
• Cisco SPA941 4-Line IP Phone With 1-Port Ethernet: any version
• Cisco SPA942 4-Line IP Phone With 2-Port Switch: any version
• Cisco SPA962 6-Line IP Phone With 2-Port Switch: any version
• Cisco Spa 301 1 Line IP Phone: any version
• Cisco Spa 303 3 Line IP Phone: any version
• Cisco Spa 501g 8-Line IP Phone: any version
• Cisco Spa 502g 1-Line IP Phone: any version
• Cisco Spa 504g 4-Line IP Phone: any version
• Cisco Spa 508g 8-Line IP Phone: any version
• Cisco Spa 509g 12-Line IP Phone: any version
• Cisco Spa 512g 1-Line IP Phone: any version
• Cisco Spa 514g 4-Line IP Phone: any version
• Cisco Spa 525g2 5-Line IP Phone: any version
• Cisco Spa 525g 5-Line IP Phone: any version

Published 2014-07-09. Last modified 2026-06-17.