CVE-2019-12708

CWE-200 — Information Exposure4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.5%
top 36.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco Cisco Spa112 2-port Phone AdapterCisco Spa112 FirmwareCisco Spa122 Firmware
Timeline
PublishedOct 16
Latest updateMay 24

Description

A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to unsafe handling of user credentials. An attacker could exploit this vulnerability by viewing portions of the web-based management interface of an affected device. A successful exploit could allow the attacker to access administrative credentials and potentially…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDcisco/spa112_firmware< 1.4.1+1
▶NVDcisco/spa122_firmware< 1.4.1+1
▶CVEListV5cisco/cisco_spa112_2-port_phone_adapterunspecified — n/a

🔴Vulnerability Details

2
GHSA
GHSA-vmg7-f8qc-j744: A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote att↗2022-05-24
▶
CVEList
Cisco SPA100 Series Analog Telephone Adapters Administrative Credentials Information Disclosure Vulnerability↗2019-10-16
▶

📋Vendor Advisories

1
Cisco
Cisco SPA100 Series Analog Telephone Adapters Administrative Credentials Information Disclosure Vulnerability↗2019-10-16
▶