description: A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conduct XSS attacks. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
problem types: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
affected:
{
vendor: Cisco
product: Cisco Small Business IP Phones
versions:
version: 7.6.0, status: affected
version: 7.6.2, status: affected
version: 7.6.2SR3, status: affected
version: 7.6.2SR6, status: affected
version: 7.6.2SR2, status: affected
version: 7.6.2SR4, status: affected
version: 7.6.2SR1, status: affected
version: 7.6.2SR5, status: affected
version: 7.6.2SR7, status: affected
version: 7.6.1, status: affected
version: 7.3.7, status: affected
version: 7.5.5, status: affected
version: 7.5.6(XU), status: affected
version: 7.5.2, status: affected
version: 7.5.2a, status: affected
version: 7.5.7, status: affected
version: 7.5.3, status: affected
version: 7.5.6, status: affected
version: 7.5.2b, status: affected
version: 7.5.6c, status: affected
version: 7.5.6a, status: affected
version: 7.5.7s, status: affected
version: 7.5.1, status: affected
version: 7.5.5a, status: affected
version: 7.5.5b, status: affected
version: 7.5.4, status: affected
version: 7.4.7, status: affected
version: 7.4.4, status: affected
version: 7.4.8, status: affected
version: 7.4.3, status: affected
version: 7.4.9, status: affected
version: 7.4.6, status: affected
}
metrics:
format: cvssV3_1
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
]
exploits: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.