CVE-2017-12271 Cross-site request forgery in Cisco SPA300 and SPA500 Series IP Phones
Unauthenticated remote attackers can execute unwanted actions on Cisco IP phones via CSRF by tricking users into visiting malicious sites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-12271?
CVE-2017-12271 is a high-severity vulnerability in Cisco SPA300 and SPA500 Series IP Phones, published on 19 Oct 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this vulnerability by tricking the user of a web application into executing an adverse action. Cisco Bug IDs: CSCuz88421, CSCuz91356, CSCve56308.
Weakness: CWE-352
Which versions are affected by CVE-2017-12271?
It affects 2 products.
Products include Cisco Spa300 Firmware, Cisco Spa500 Firmware.
How do I fix CVE-2017-12271?
No fix has been published for CVE-2017-12271 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-12271 being exploited?
There is no known exploitation of CVE-2017-12271 in the wild and no public exploit code.
Other vulnerabilities in Cisco SPA300 and SPA500 Series IP Phones
Sources
Also known as GHSA-wp8q-4497-mj3j.