Hello? Are you talking on a Cisco SPA300 or SPA500 IP phone? Now's the time to junk 'em

Cisco disclosed five vulnerabilities affecting the web management interface of Small Business SPA300/SPA500 IP phones — three critical CVEs (CVSS 9.8) that allow unauthenticated remote buffer-overflow and root command execution via crafted HTTP requests, and two CVSS 7.8 issues that can cause denial of service. Cisco will not issue patches because the product line is end-of-life, leaving owners to replace affected hardware or run unsupported and vulnerable devices; no active exploitation has been reported so far.