CVE-2019-15257

CWE-200 — Information Exposure4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.5%
top 36.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco Cisco Spa112 2-port Phone AdapterCisco Spa112 FirmwareCisco Spa122 Firmware
Timeline
PublishedOct 16
Latest updateMay 24

Description

A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper restrictions on configuration information. An attacker could exploit this vulnerability by sending a request to an affected device through the web-based management interface. A successful exploit could allow the attacker to return running configuration…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDcisco/spa112_firmware< 1.4.1+1
▶NVDcisco/spa122_firmware< 1.4.1+1
▶CVEListV5cisco/cisco_spa112_2-port_phone_adapterunspecified — n/a

🔴Vulnerability Details

2
GHSA
GHSA-fvjv-pj79-3x2j: A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote att↗2022-05-24
▶
CVEList
Cisco SPA100 Series Analog Telephone Adapters Running Configuration Information Disclosure Vulnerability↗2019-10-16
▶

📋Vendor Advisories

1
Cisco
Cisco SPA100 Series Analog Telephone Adapters Running Configuration Information Disclosure Vulnerability↗2019-10-16
▶