PT-2023-2522 · Cisco · Cisco Ata 190 +1

Catalpa

·

Published

2023-05-03

·

Updated

2023-08-26

·

CVE-2023-20126

Report an issue
CVSS v3.1
10
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

Cisco SPA112 versions (affected versions not specified)

Description:

A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. A successful exploit could allow the attacker to execute arbitrary code on the affected device with full privileges.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability. Cisco has stated that they will not release firmware updates to address this vulnerability since the 2-Port Phone Adapters are already end-of-life. As a workaround, Cisco recommends transitioning to the Cisco ATA 190 series analog telephone adapter.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-02321
CVE-2023-20126

Affected Products

Cisco Ata 190
Cisco Spa112