CVE-2019-15257
published 2019-10-16CVE-2019-15257: A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to…
PriorityP336medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.09%
65.0th percentile
A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper restrictions on configuration information. An attacker could exploit this vulnerability by sending a request to an affected device through the web-based management interface. A successful exploit could allow the attacker to return running configuration information that could also include sensitive information.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_spa112_2-port_phone_adapter | >= unspecified < n/a | n/a |
| cisco | spa100_series_analog_telephone_adapters_running_configuration | — | — |
| cisco | spa112_firmware | < 1.4.1 | 1.4.1 |
| cisco | spa112_firmware | — | — |
| cisco | spa122_firmware | < 1.4.1 | 1.4.1 |
| cisco | spa122_firmware | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco SPA100 Series Analog Telephone Adapters Running Configuration Information Disclosure Vulnerability
vendor_cisco·2019-10-16·CVSS 6.5
CVE-2019-15257 [MEDIUM] CWE-200 Cisco SPA100 Series Analog Telephone Adapters Running Configuration Information Disclosure Vulnerability
Cisco SPA100 Series Analog Telephone Adapters Running Configuration Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to access sensitive information on an affected device.
The vulnerability is due to improper restrictions on configuration information. An attacker could exploit this vulnerability by sending a request to an affected device through the web-based management interface. A successful exploit could allow the attacker to return running configuration information that could also include sensitive information.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisc
Cisco
Cisco SPA100 Series Analog Telephone Adapters Running Configuration Information Disclosure Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-15257 Cisco SPA100 Series Analog Telephone Adapters Running Configuration Information Disclosure Vulnerability
CVE-2019-15257: Cisco SPA100 Series Analog Telephone Adapters Running Configuration Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper restrictions on configuration information. An attacker could exploit this vulnerability by sending a request to an affected device through the web-based management interface. A successful exploit could allow the attacker to return running configuration information that could also include sensitive information. There are no
CVSS: 3.0
CWE: CWE-200, CWE-200
Bug IDs: CSCvq50523
GHSA
GHSA-fvjv-pj79-3x2j: A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote att
ghsa_unreviewed·2022-05-24
CVE-2019-15257 [MEDIUM] GHSA-fvjv-pj79-3x2j: A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote att
A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper restrictions on configuration information. An attacker could exploit this vulnerability by sending a request to an affected device through the web-based management interface. A successful exploit could allow the attacker to return running configuration information that could also include sensitive information.
No detection rules found.
No public exploits indexed.
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-spa-running-confighttps://www.tenable.com/security/research/tra-2019-44https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-spa-running-confighttps://www.tenable.com/security/research/tra-2019-44
2019-10-16
Published