CVE-2019-12708 - Cisco SPA100 Series Analog Telephone Adapters Administrative Credentials Information Disclosure Vulnerability

Back Back to CVE browser

MEDIUM

Cisco SPA100 Series Analog Telephone Adapters Administrative Credentials Information Disclosure Vulnerability

Published Oct 16, 2019

6.5

MEDIUM

CVSS 3.1

EPSS 1.09%

Description

A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to unsafe handling of user credentials. An attacker could exploit this vulnerability by viewing portions of the web-based management interface of an affected device. A successful exploit could allow the attacker to access administrative credentials and potentially gain elevated privileges by reusing stolen credentials on the affected device.

Affected products

Vendor Cisco Product Cisco SPA112 2-Port Phone Adapter Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco SPA112 2-Port Phone Adapter

n/a

Version	Status	Constraints
unspecified	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (2)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-spa-credentials
vendor-advisoryx_refsource_CISCOVendor Advisory
https://www.tenable.com/security/research/tra-2019-44
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-spa-credentials		vendor-advisoryx_refsource_CISCOVendor Advisory
https://www.tenable.com/security/research/tra-2019-44		x_refsource_MISCThird Party Advisory