CVE-2019-15251

CVE-2019-15251 describes multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs), specifically affecting the SPA112 and SPA122 models. These flaws stem from improper input validation in the web-based management interface, which is enabled by default. An authenticated, adjacent attacker could exploit these vulnerabilities by sending crafted requests, leading to arbitrary code execution with elevated privileges. The vulnerability has a CVSS score of 8.0 (HIGH), indicating a significant risk. Exploitation requires authentication and adjacency, but the impact is high for confidentiality, integrity, and availability. Despite the high severity, there is no evidence of active exploitation, nor is there publicly available exploit code in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, with zero mentions across social media and news articles, which is typical for a large percentage of CVEs. The EPSS score is very low, suggesting a low probability of exploitation in the wild.