PT-2019-3823 · Cisco · Cisco Spa122 Ata

Publicado 2019-10-16 · Atualizado 2019-10-21 · CVE-2019-12703

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco SPA122 ATA (affected versions not specified)

Description The issue exists due to insufficient protection of the web page structure in the web-based management interface. An attacker could exploit this by sending specially crafted DHCP requests and persuading a user to click a crafted link, potentially allowing the execution of arbitrary code or access to confidential information. The vulnerability can also be exploited through cross-site scripting attacks due to insufficient validation of user-supplied input.

Recommendations For Cisco SPA122 ATA, consider disabling the web-based management interface until a patch is available to prevent exploitation. Restrict access to the device to minimize the risk of exploitation through crafted DHCP requests and malicious links. Avoid using the web-based management interface for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-04150

CVE-2019-12703

Produtos afetados

Cisco Spa122 Ata

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-12703 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-spa-dhcp-xss · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-12703 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-04150 · Nota de Segurança