CVE-2019-15257: medium-severity vulnerability in Cisco SPA112 2-Port Phone Adapter
Cisco SPA100 Series Analog Telephone Adapters Running Configuration Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 1.1%
A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper restrictions on configuration information. An attacker could exploit this vulnerability by sending a request to an affected device through the web-based management interface. A successful exploit could allow the attacker to return running configuration information that could also include sensitive information.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Cisco · Cisco SPA112 2-Port Phone AdapterRelated CVEs — Cisco SPA112 2-Port Phone Adapter
In the same product, most dangerous first.
CVE-2019-12704MEDIUMCisco SPA100 Series Analog Telephone Adapters Web-Based Management Interface File Disclosure VulnerabilityEPSS 1.6%CVE-2019-15258MEDIUMCisco SPA100 Series Analog Telephone Adapters Web Management Interface Denial of Service VulnerabilityEPSS 1.4%CVE-2019-12708MEDIUMCisco SPA100 Series Analog Telephone Adapters Administrative Credentials Information Disclosure VulnerabilityEPSS 1.1%CVE-2019-1956MEDIUMCisco SPA112 2-Port Phone Adapter Stored Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2019-12702MEDIUMCisco SPA100 Series Analog Telephone Adapters Reflected Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2019-15252HIGHCisco SPA100 Series Analog Telephone Adapters Remote Code Execution VulnerabilitiesEPSS 0.6%