CVE-2019-12708

Cisco SPA100 Series Analog Telephone Adapters expose an information-disclosure vulnerability in the web-based management interface due to unsafe handling of credentials. An authenticated, remote attacker could view portions of the interface to access administrative credentials and potentially reu...

CVE-2019-15257

CVE-2019-15257 affects Cisco SPA100 Series ATAs. The vulnerability arises in the web-based management interface where improper restrictions on configuration information allow an authenticated remote attacker to retrieve running configuration data, potentially exposing sensitive information. Impac...

CVE-2019-15243

CVE-2019-15243 affects Cisco SPA100 Series ATAs. The issue stems from improper validation of input to the web-based management interface , allowing an authenticated, adjacent attacker to send crafted requests and execute arbitrary code with elevated privileges . The vulnerabilities enable remote ...

CVE-2019-15249

CVE-2019-15249 describes multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) due to improper validation of user-supplied input to the web-based management interface. An authenticated, adjacent attacker can craft requests to the affected device, potentially executing a...

CVE-2019-15240

Cisco SPA100 Series Analog Telephone Adapters are affected by multiple remote code execution vulnerabilities (CVE-2019-15240) due to improper validation of input to the web management interface. An authenticated, adjacent attacker can send crafted requests after logging into the web interface, po...

CVE-2019-12704

The CVE-2019-12704 issue affects Cisco SPA100 Series Analog Telephone Adapters and concerns the web-based management interface. Root cause: improper input validation in the management UI, which allows an authenticated (and per some sources unauthenticated) attacker to send crafted requests that d...

CVE-2019-12702

The Cisco SPA100 Series Analogue Telephone Adapters are affected by a cross-site scripting vulnerability in the web-based management interface (CVE-2019-12702). The issue stems from insufficient validation of user-supplied input, allowing an authenticated attacker to lure a user into clicking a c...

CVE-2019-15247

Cisco SPA100 Series ATAs are affected by CVE-2019-15247 due to improper validation of input to the device’s web-based management interface. An authenticated, adjacent attacker could craft requests to the affected device and execute arbitrary code with elevated privileges, with the management inte...

CVE-2019-15252

Cisco SPA100 Series ATAs are affected by multiple vulnerabilities due to improper validation of input to the web-based management interface. An authenticated, adjacent attacker can send crafted requests to the device and execute arbitrary code with elevated privileges. The web UI is enabled by de...

CVE-2019-15246

The CVE-2019-15246 issue affects Cisco SPA100 Series Analog Telephone Adapters (ATAs). The root cause is improper validation of user-supplied input to the web-based management interface, enabling an authenticated, adjacent attacker to send crafted requests that could execute arbitrary code with e...

CVE-2019-15248

Cisco SPA100 Series ATAs are affected by multiple remote-code-execution vulnerabilities due to improper validation of input in the web-based management interface. Authentication to the management interface and crafted requests can lead to arbitrary code execution with elevated privileges, with th...

CVE-2019-15251

CVE-2019-15251 affects Cisco SPA100 Series ATAs. The issue arises from improper validation of user-supplied input in the web-based management interface, enabling an authenticated, adjacent attacker to send crafted requests and execute arbitrary code with elevated privileges (remote code execution...

CVE-2019-15245

Cisco SPA100 Series ATAs are affected by CVE-2019-15245, with multiple reviewed advisories confirming remote code execution via improper validation of input to the web-based management interface. An authenticated, adjacent attacker who can access the device’s web UI can craft requests to execute ...

CVE-2019-15250

The provided documents describe CVE-2019-15250 in Cisco SPA100 Series Analog Telephone Adapters (ATAs). Affected component: web-based management interface of Cisco SPA100 Series ATAs. Root cause: improper validation of user-supplied input to the web management interface, enabling an authenticated...

CVE-2019-15244

Cisco SPA100 Series ATAs are affected by multiple remote code execution vulnerabilities due to improper validation of input to the web-based management interface. An authenticated, adjacent attacker could exploit crafted requests to execute arbitrary code with elevated privileges. The web UI is e...

CVE-2023-20126

Cisco SPA112 (2-Port) has a remote command execution vulnerability (CVE-2023-20126) due to a missing authentication step in the firmware upgrade flow. An unauthenticated attacker can upgrade to crafted firmware to run arbitrary code with full privileges. A PoC exists (RancidCrisco) that gains a r...

CVE-2019-15258

CVE-2019-15258 affects Cisco SPA100 Series ATAs web-based management interface. Description and connected sources confirm an authenticated, remote attacker can exploit improper validation of user-supplied requests to the web UI, causing a denial-of-service condition where the device stops respond...

CVE-2019-15242

The CVE-2019-15242 entry concerns Cisco SPA100 Series Analog Telephone Adapters. The connected sources describe multiple vulnerabilities arising from improper validation of user-supplied input to the devices’ web-based management interface, allowing an authenticated, adjacent attacker to execute ...

CVE-2019-15241

Cisco SPA100 Series Analog Telephone Adapters are affected by multiple CVEs, including CVE-2019-15241. The root cause is improper validation of user-supplied input in the devices’ web-based management interface, enabling an authenticated adjacent attacker to execute arbitrary code with elevated p...

CVE-2019-1683

CVE-2019-1683 affects Cisco Small Business SPA112, SPA500, SPA525, and SPA5X5 IP Phones. The issue is in the certificate handling component where server certificates are not properly validated, allowing an unauthenticated, remote attacker to listen to or control parts of a TLS-encrypted SIP conve...