Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-1683

A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security (TLS)-encrypted Session Initiation Protocol (SIP) conversation. The vulnerability is due to the improper validation of server certificates. An attacker could exploit this vulnerability by crafting a malicious server certificate to present to the client. An exploit could allow an attacker to eavesdrop on TLS-encrypted traffic and potentially route or redirect calls initiated by an affected device. Affected software include version 7.6.2 of the Cisco Small Business SPA525 Series IP Phones and Cisco Small Business SPA5X5 Series IP Phones and version 1.4.2 of the Cisco Small Business SPA500 Series IP Phones and Cisco Small Business SPA112 Series IP Phones.

Published

2019-02-25T17:29:00.280

Last Modified

2024-11-21T04:37:05.440

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.4 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

4.9

Weaknesses
  • Type: Secondary
    CWE-295
  • Type: Primary
    CWE-295
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System cisco spa112_firmware 1.4.2 Yes
Hardware cisco spa112 - No
Operating System cisco spa525_firmware 7.6.2 Yes
Hardware cisco spa525 - No
Operating System cisco spa5x5_firmware 7.6.2 Yes
Hardware cisco spa5x5 - No
Operating System cisco spa500_firmware 1.4.2 Yes
Operating System cisco spa500 - No
Operating System cisco spa500s_firmware 1.4.2 Yes
Hardware cisco spa500s - No
Operating System cisco spa500ds_firmware 1.4.2 Yes
Hardware cisco spa500ds - No
Operating System cisco spa501g_firmware 1.4.2 Yes
Hardware cisco spa501g - No
Operating System cisco spa502g_firmware 1.4.2 Yes
Hardware cisco spa502g - No
Operating System cisco spa504g_firmware 1.4.2 Yes
Hardware cisco spa504g - No
Operating System cisco spa508g_firmware 1.4.2 Yes
Hardware cisco spa508g - No
Operating System cisco spa509g_firmware 1.4.2 Yes
Hardware cisco spa509g - No
Operating System cisco spa512g_firmware 1.4.2 Yes
Hardware cisco spa512g - No
Operating System cisco spa514g_firmware 1.4.2 Yes
Hardware cisco spa514g - No
Operating System cisco spa525g_firmware 1.4.2 Yes
Hardware cisco spa525g - No
References