Cisco SPA122 ATA Web-based Management Interface DHCP Request cross site scripting

Summaryinfo

A vulnerability marked as problematic has been reported in Cisco SPA122 ATA. The impacted element is an unknown function of the component Web-based Management Interface. The manipulation as part of DHCP Request leads to cross site scripting. This vulnerability is uniquely identified as CVE-2019-12703. The attack can only be initiated within the local network. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Cisco SPA122 ATA (the affected version is unknown). This issue affects an unknown code of the component Web-based Management Interface. The manipulation as part of a DHCP Request leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

A vulnerability in the web-based management interface of Cisco SPA122 ATA with Router Devices could allow an unauthenticated, adjacent attacker to conduct cross-site scripting attacks. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by sending malicious input to the affected software through crafted DHCP requests, and then persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

The weakness was disclosed 10/16/2019 as cisco-sa-20191016-spa-dhcp-xss as confirmed advisory (Website). The advisory is shared at tools.cisco.com. The identification of this vulnerability is CVE-2019-12703 since 06/04/2019. The attack needs to be initiated within the local network. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Cisco

Name

• SPA122 ATA

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion