PT-2019-3823 · Cisco · Cisco Spa122 Ata

Published 2019-10-16 · Updated 2019-10-21 · CVE-2019-12703

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco SPA122 ATA (affected versions not specified)

Description The issue exists due to insufficient protection of the web page structure in the web-based management interface. An attacker could exploit this by sending specially crafted DHCP requests and persuading a user to click a crafted link, potentially allowing the execution of arbitrary code or access to confidential information. The vulnerability can also be exploited through cross-site scripting attacks due to insufficient validation of user-supplied input.

Recommendations For Cisco SPA122 ATA, consider disabling the web-based management interface until a patch is available to prevent exploitation. Restrict access to the device to minimize the risk of exploitation through crafted DHCP requests and malicious links. Avoid using the web-based management interface for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-04150

CVE-2019-12703

Affected Products

Cisco Spa122 Ata

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-12703 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-spa-dhcp-xss · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12703 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04150 · Security Note