What is CVE-2019-1923?

CVE-2019-1923 is a medium-severity vulnerability in Cisco Spa525g2 5-line Ip Phone, classified under Command Injection. CVSS score: 6.6/10. Published 2019-07-17.

How severe is CVE-2019-1923?

Medium severity. CVSS v3 base score is 6.6 out of 10.

RCE in Cisco Spa525g2 5-line Ip Phone

CVE-2019-1923

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration inte…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.005 (37.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cisco Spa525g2 5-line Ip Phone — versions unspecified
Cisco Spa500ds
Cisco Spa500ds_firmware
Cisco Spa500s
Cisco Spa500s_firmware
Cisco Spa501g
Cisco Spa501g_firmware
Cisco Spa502g
Cisco Spa502g_firmware
Cisco Spa504g

Weakness classification (CWE)

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2019-1923?: CVE-2019-1923 is a medium-severity vulnerability in Cisco Spa525g2 5-line Ip Phone, classified under Command Injection. CVSS score: 6.6/10. Published 2019-07-17.
How severe is CVE-2019-1923?: Medium severity. CVSS v3 base score is 6.6 out of 10.