A vulnerability was found in Cisco SPA100 ATA (the affected version unknown). It has been classified as critical. Affected is an unknown part of the component Web-based Management Interface. The manipulation as part of a Request leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

The weakness was published 10/16/2019 as cisco-sa-20191016-spa-rce as confirmed advisory (Website). The advisory is available at tools.cisco.com. This vulnerability is traded as CVE-2019-15247 since 08/20/2019. The attack needs to be done within the local network. A authentication is necessary for exploitation. The technical details are unknown and an exploit is not available.

Upgrading eliminates this vulnerability.

Productinfo

Vendor

• Cisco

Name

• SPA100 ATA

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion