6.6

CVE-2019-1923

Cisco Small Business SPA500 Series IP Phones Local Command Execution Vulnerability

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by accessing the configuration interface, which may require a password, and then accessing the device's physical interface and inserting a USB storage device. A successful exploit could allow the attacker to execute arbitrary commands on the device in an elevated security context. At the time of publication, this vulnerability affected Cisco Small Business SPA500 Series IP Phones firmware releases 7.6.2SR5 and prior.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Spa501g Firmware Version <= 7.6.2sr5
   Cisco ≫ Spa501g Version -
Cisco ≫ Spa502g Firmware Version <= 7.6.2sr5
   Cisco ≫ Spa502g Version -
Cisco ≫ Spa504g Firmware Version <= 7.6.2sr5
   Cisco ≫ Spa504g Version -
Cisco ≫ Spa508g Firmware Version <= 7.6.2sr5
   Cisco ≫ Spa508g Version -
Cisco ≫ Spa509g Firmware Version <= 7.6.2sr5
   Cisco ≫ Spa509g Version -
Cisco ≫ Spa512g Firmware Version <= 7.6.2sr5
   Cisco ≫ Spa512g Version -
Cisco ≫ Spa514g Firmware Version <= 7.6.2sr5
   Cisco ≫ Spa514g Version -
Cisco ≫ Spa525g2 Firmware Version <= 7.6.2sr5
   Cisco ≫ Spa525g2 Version -
Cisco ≫ Spa500s Firmware Version <= 7.6.2sr5
   Cisco ≫ Spa500s Version -
Cisco ≫ Spa500ds Firmware Version <= 7.6.2sr5
   Cisco ≫ Spa500ds Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.371
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.6 0.7 5.9
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
Cisco PSIRT 6.6 0.7 5.9
CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

http://www.securityfocus.com/bid/109294
Third Party Advisory
VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-spa500-command
Vendor Advisory