Cisco SPA300 and SPA500 Series IP Phones CVE-2017-12271 Cross Site Request Forgery Vulnerability

Bugtraq ID:	101524
Class:	Design Error
CVE:	CVE-2017-12271
Remote:	Yes
Local:	No
Published:	Oct 18 2017 12:00AM
Updated:	Oct 18 2017 12:00AM
Credit:	Chris Watts of Tech Analysis.
Vulnerable:	Cisco SPA500 Series IP Phones 0 Cisco SPA300 Series IP Phones 0 Cisco Small Business SPA500 Series IP Phones 7.5.5 Cisco Small Business IP Phones 7.5.5
Not Vulnerable:	Cisco Small Business SPA500 Series IP Phones 7.6(2)SR3 Cisco Small Business IP Phones 7.6(2)SR3

Cisco SPA300 and SPA500 Series IP Phones CVE-2017-12271 Cross Site Request Forgery Vulnerability

Cisco SPA300 and SPA500 Series IP Phones are prone to an cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

This issue is being tracked by Cisco Bug IDs CSCuz88421, CSCuz91356 and CSCve56308.

Cisco SPA300 and SPA500 Series IP Phones CVE-2017-12271 Cross Site Request Forgery Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

Cisco SPA300 and SPA500 Series IP Phones CVE-2017-12271 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco SPA300 and SPA500 Series IP Phones CVE-2017-12271 Cross Site Request Forgery Vulnerability

References:

• Cisco Homepage (Cisco)
  
• cisco-sa-20171018-spa: Cisco SPA300 and SPA500 Series IP Phones Cross-Site Requ (Cisco)