PT-2023-2522 · Cisco · Cisco Ata 190+1

Catalpa

·

Published

2023-05-03

·

Updated

2023-08-26

·

CVE-2023-20126

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Cisco SPA112 versions (affected versions not specified)
Description A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. A successful exploit could allow the attacker to execute arbitrary code on the affected device with full privileges.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Cisco has stated that they will not release firmware updates to address this vulnerability since the 2-Port Phone Adapters are already end-of-life. As a workaround, Cisco recommends transitioning to the Cisco ATA 190 series analog telephone adapter.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-02321
CVE-2023-20126

Affected Products

Cisco Ata 190
Cisco Spa112