View all newsletters
Receive our newsletter - data, insights and analysis delivered to you

Cisco reveals IP phones are vulnerable to eavesdropping

Hackers could listen in to customers' calls.

By Jimmy Nicholls

Cisco has revealed that some of its IP phones are vulnerable to eavesdropping, allowing hackers to remotely listen in to the messages of the firm’s customers.

The problem with the Small Business SPA300 and SPA500 Series of phones is due to "improper authentication" in the default settings of the products, which allows hackers to attack a device by sending a specially crafted XML request.

"An unauthenticated, remote attacker could exploit this vulnerability to listen to a remote audio stream from an affected device or to gain access to make phone calls remotely," Cisco said.

Though the bug has yet to be patched by the vendor, it does not believe it is likely to be exploited.

"To exploit this vulnerability, an attacker may need access to trusted, internal networks behind a firewall to send crafted XML requests to the targeted device," Cisco said. "This access requirement may reduce the likelihood of a successful exploit."

However it added that: "A successful exploit could be used to conduct further attacks."

Later versions of the Cisco Small Business SPA 300 and 500 Series phones are also said to be potentially affected.

Content from our partners
Rethinking cloud: challenging assumptions, learning lessons
DTX Manchester welcomes leading tech talent from across the region and beyond
The hidden complexities of deploying AI in your business

Admins are advised to enable XML Execution authentication to guard against the problem, as well as only allow trusted users onto the network or the affected systems.

The bug can also be mitigated against through standard network defences, including "a solid firewall strategy".

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.