CVE-2019-12708
published 2019-10-16CVE-2019-12708: A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to…
PriorityP338medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.09%
61.6th percentile
A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to unsafe handling of user credentials. An attacker could exploit this vulnerability by viewing portions of the web-based management interface of an affected device. A successful exploit could allow the attacker to access administrative credentials and potentially gain elevated privileges by reusing stolen credentials on the affected device.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_spa112_2-port_phone_adapter | >= unspecified < n/a | n/a |
| cisco | spa100_series_analog_telephone_adapters_administrative_credentials | — | — |
| cisco | spa112_firmware | < 1.4.1 | 1.4.1 |
| cisco | spa112_firmware | — | — |
| cisco | spa122_firmware | < 1.4.1 | 1.4.1 |
| cisco | spa122_firmware | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco SPA100 Series Analog Telephone Adapters Administrative Credentials Information Disclosure Vulnerability
vendor_cisco·2019-10-16·CVSS 6.5
CVE-2019-12708 [MEDIUM] CWE-200 Cisco SPA100 Series Analog Telephone Adapters Administrative Credentials Information Disclosure Vulnerability
Cisco SPA100 Series Analog Telephone Adapters Administrative Credentials Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to access sensitive information on an affected device.
The vulnerability is due to unsafe handling of user credentials. An attacker could exploit this vulnerability by viewing portions of the web-based management interface of an affected device. A successful exploit could allow the attacker to access administrative credentials and potentially gain elevated privileges by reusing stolen credentials on the affected device.
There are no workarounds that address this vulnerability
This advisory is available at the following link:
ht
Cisco
Cisco SPA100 Series Analog Telephone Adapters Administrative Credentials Information Disclosure Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-12708 Cisco SPA100 Series Analog Telephone Adapters Administrative Credentials Information Disclosure Vulnerability
CVE-2019-12708: Cisco SPA100 Series Analog Telephone Adapters Administrative Credentials Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to unsafe handling of user credentials. An attacker could exploit this vulnerability by viewing portions of the web-based management interface of an affected device. A successful exploit could allow the attacker to access administrative credentials and potentially gain elevated privileges by reusing stolen credentials on the affected device. There are no
CVSS: 3.0
CWE: CWE-200, CWE-200
Bug IDs: CSCvq50520
GHSA
GHSA-vmg7-f8qc-j744: A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote att
ghsa_unreviewed·2022-05-24
CVE-2019-12708 [MEDIUM] CWE-200 GHSA-vmg7-f8qc-j744: A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote att
A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to unsafe handling of user credentials. An attacker could exploit this vulnerability by viewing portions of the web-based management interface of an affected device. A successful exploit could allow the attacker to access administrative credentials and potentially gain elevated privileges by reusing stolen credentials on the affected device.
No detection rules found.
No public exploits indexed.
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-spa-credentialshttps://www.tenable.com/security/research/tra-2019-44https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-spa-credentialshttps://www.tenable.com/security/research/tra-2019-44
2019-10-16
Published