CVE-2014-3312
The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly...
The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435.
Exploit likelihood
What each source reports
NVD Score used
The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435.
- Record
CVE-2014-3312- CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435.
- Record
CVE-2014-3312- Updated
- 2026-11-02
EUVDEUVD-2014-3325 No score
The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435.
- Record
EUVD-2014-3325- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xgrh-89p6-c4pw No score
The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly...
The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435.
- Record
GHSA-xgrh-89p6-c4pw- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
- cisco spa901 1-line ip phone
- cisco spa922 1-line ip phone with 1-port ethernet
- cisco spa941 4-line ip phone with 1-port ethernet
- cisco spa942 4-line ip phone with 2-port switch
- cisco spa962 6-line ip phone with 2-port switch
- cisco spa 301 1 line ip phone
- cisco spa 303 3 line ip phone
- cisco spa 501g 8-line ip phone
- cisco spa 502g 1-line ip phone
- cisco spa 504g 4-line ip phone
- cisco spa 508g 8-line ip phone
- cisco spa 509g 12-line ip phone
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3312 is a medium vulnerability (CVSS 6.9) in Cisco Spa901 1-line Ip Phone, published July 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. No source names a fixed version.