Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-1923

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by accessing the configuration interface, which may require a password, and then accessing the device's physical interface and inserting a USB storage device. A successful exploit could allow the attacker to execute arbitrary commands on the device in an elevated security context. At the time of publication, this vulnerability affected Cisco Small Business SPA500 Series IP Phones firmware releases 7.6.2SR5 and prior.

Published

2019-07-17T21:15:12.170

Last Modified

2024-11-21T04:37:41.697

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.6 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

3.9

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-77
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System cisco spa501g_firmware ≤ 7.6.2sr5 Yes
Hardware cisco spa501g - No
Operating System cisco spa502g_firmware ≤ 7.6.2sr5 Yes
Hardware cisco spa502g - No
Operating System cisco spa504g_firmware ≤ 7.6.2sr5 Yes
Hardware cisco spa504g - No
Operating System cisco spa508g_firmware ≤ 7.6.2sr5 Yes
Hardware cisco spa508g - No
Operating System cisco spa509g_firmware ≤ 7.6.2sr5 Yes
Hardware cisco spa509g - No
Operating System cisco spa512g_firmware ≤ 7.6.2sr5 Yes
Hardware cisco spa512g - No
Operating System cisco spa514g_firmware ≤ 7.6.2sr5 Yes
Hardware cisco spa514g - No
Operating System cisco spa525g2_firmware ≤ 7.6.2sr5 Yes
Hardware cisco spa525g2 - No
Operating System cisco spa500s_firmware ≤ 7.6.2sr5 Yes
Hardware cisco spa500s - No
Operating System cisco spa500ds_firmware ≤ 7.6.2sr5 Yes
Hardware cisco spa500ds - No
References