PT-2019-3975 · Cisco · Cisco Small Business Spa500 Series Ip Phones

Published 2019-11-06 · Updated 2020-10-08 · CVE-2019-15959

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Small Business SPA500 Series IP Phones (affected versions not specified)

Description A vulnerability in the Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The issue is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit this by accessing the physical interface of a device and inserting a USB storage device, potentially allowing the execution of scripts in an elevated security context. The vulnerability is also related to insufficient input validation, which could allow an attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-04506

CVE-2019-15959

Affected Products

Cisco Small Business Spa500 Series Ip Phones

References · 5

• https://osv.dev/vulnerability/CVE-2019-15959 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-spa500-script · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04506 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-15959 · Security Note
• https://t.me/cibsecurity/14840 · Telegram Post