CVE:CVE-2014-3312
CNNVD:CNNVD-201407-232
Cisco Small Business SPA300和SPA500 IP Phones都是美国思科（Cisco）公司的S系列的IP电话产品。
Cisco Small Business SPA300和SPA500 IP Phones的调试控制台界面中存在安全漏洞，该漏洞源于程序没有正确执行身份验证。本地攻击者可通过发送特制的命令利用该漏洞执行debug-shell任意命令，读取或修改内存或文件系统中的数据。
solution:Upgrade cisco spa_301_1_line_ip_phone to a higher version than *; Upgrade cisco spa_303_3_line_ip_phone to a higher version than *; Upgrade cisco spa_501g_8-line_ip_phone to a higher version than *; Upgrade cisco spa_502g_1-line_ip_phone to a higher version than *; Upgrade cisco spa_504g_4-line_ip_phone to a higher version than *; Upgrade cisco spa_508g_8-line_ip_phone to a higher version than *; Upgrade cisco spa_509g_12-line_ip_phone to a higher version than *; Upgrade cisco spa_512g_1-line_ip_phone to a higher version than *; Upgrade cisco spa_514g_4-line_ip_phone to a higher version than *; Upgrade cisco spa_525g_5-line_ip_phone to a higher version than *; Upgrade cisco spa_525g2_5-line_ip_phone to a higher version than *; Upgrade cisco spa901_1-line_ip_phone to a higher version than *; Upgrade cisco spa922_1-line_ip_phone_with_1-port_ethernet to a higher version than *; Upgrade cisco spa941_4-line_ip_phone_with_1-port_ethernet to a higher version than *; Upgrade cisco spa942_4-line_ip_phone_with_2-port_switch to a higher version than *; Upgrade cisco spa962_6-line_ip_phone_with_2-port_switch to a higher version than *