Lucene search

CiscoCVE-2023-20126

HistoryMay 04, 2023 - 8:15 p.m.

CVE-2023-20126

2023-05-0420:15:09

CWE-306

cisco

web.nvd.nist.gov

cve-2023

20126

cisco

spa112

phone adapter

remote code execution

vulnerability

firmware

authentication

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.003

Percentile

71.8%

JSON

A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. A successful exploit could allow the attacker to execute arbitrary code on the affected device with full privileges. Cisco has not released firmware updates to address this vulnerability.

Affected configurations

Nvd

Node

ciscospa112_firmwareMatch1.4.1sr9

AND

ciscospa112Match-

VendorProductVersionCPE
ciscospa112_firmware1.4.1cpe:2.3:o:cisco:spa112_firmware:1.4.1:sr9:*:*:*:*:*:*
ciscospa112-cpe:2.3:h:cisco:spa112:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	spa112_firmware	1.4.1	cpe:2.3:o:cisco:spa112_firmware:1.4.1:sr9::::::
cisco	spa112	-	cpe:2.3:h:cisco:spa112:-:::::::*

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Small Business IP Phones ",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ]
  }
]

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-unauth-upgrade-UqhyTWW

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.003

Percentile

71.8%

JSON

Related for CVE-2023-20126