CVE-2019-15249 describes multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (SPA112 and SPA122 models) stemming from improper input validation in the web-based management interface. An authenticated, adjacent attacker can exploit these flaws by sending crafted requests, leading to arbitrary code execution with elevated privileges. With a CVSS score of 8.0 (High), this vulnerability is easily exploitable over the adjacent network with low privileges and no user interaction, resulting in high impact to confidentiality, integrity, and availability. Currently, there is no public exploit code available (Metasploit, Nuclei, ExploitDB), it is not listed in CISA's KEV catalog, and there is no significant community discussion or media coverage, indicating it is not actively exploited or widely known.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.4.1CPE matchmatch criteria | cpe:2.3:o:cisco:spa112_firmware:*:*:*:*:*:*:*:* | ||
1.4.1CPE matchmatch criteria | cpe:2.3:o:cisco:spa112_firmware:1.4.1:-:*:*:*:*:*:* | ||
1.4.1CPE matchmatch criteria | cpe:2.3:o:cisco:spa112_firmware:1.4.1:sr1:*:*:*:*:*:* | ||
1.4.1CPE matchmatch criteria | cpe:2.3:o:cisco:spa112_firmware:1.4.1:sr2:*:*:*:*:*:* | ||
1.4.1CPE matchmatch criteria | cpe:2.3:o:cisco:spa112_firmware:1.4.1:sr3:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Cisco SPA100 Series Multiple Vulnerabilities
Oct 15, 2019Cisco SPA100 Series Multiple Vulnerabilities
Oct 15, 2019Cisco SPA100 Series Multiple Vulnerabilities
Oct 15, 2019Cisco SPA100 Series Multiple Vulnerabilities
Oct 15, 2019Cisco SPA100 Series Multiple Vulnerabilities
Oct 15, 2019Cisco SPA100 Series Multiple Vulnerabilities
Oct 15, 2019