Vulnerability in Cisco Small Business Spa112 Series Ip Phones
CVE-2019-1683
A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security (TLS)-encrypt…
Vulnerability class: Improper Certificate Validation
EPSS: 0.009 (55.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Cisco Small Business Spa112 Series Ip Phones — versions 1.4.2
- Cisco Small Business Spa500 Series Ip Phones — versions 1.4.2
- Cisco Small Business Spa525 Series Ip Phones — versions 7.6.2
- Cisco Small Business Spa5x5 Series Ip Phones — versions 7.6.2
- Cisco Spa112
- Cisco Spa112_firmware — versions 1.4.2
- Cisco Spa500
- Cisco Spa500ds
- Cisco Spa500ds_firmware — versions 1.4.2
- Cisco Spa500_firmware — versions 1.4.2
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
Frequently asked questions
- What is CVE-2019-1683?
- CVE-2019-1683 is a high-severity vulnerability in Cisco Small Business Spa112 Series Ip Phones, classified under Improper Certificate Validation. CVSS score: 7.4/10. Published 2019-02-25.
- How severe is CVE-2019-1683?
- High severity. CVSS v3 base score is 7.4 out of 10.