PT-2019-3975 · Cisco · Cisco Small Business Spa500 Series Ip Phones

Publicado 2019-11-06 · Atualizado 2020-10-08 · CVE-2019-15959

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Small Business SPA500 Series IP Phones (affected versions not specified)

Description A vulnerability in the Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The issue is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit this by accessing the physical interface of a device and inserting a USB storage device, potentially allowing the execution of scripts in an elevated security context. The vulnerability is also related to insufficient input validation, which could allow an attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2019-04506

CVE-2019-15959

Produtos afetados

Cisco Small Business Spa500 Series Ip Phones

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-15959 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-spa500-script · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-04506 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-15959 · Nota de Segurança
• https://t.me/cibsecurity/14840 · Publicação no Telegram