IT

Tracker / CVE-2019-1683

CVE-2019-1683

High 7.4

A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security (TLS)-encrypted Session Initiation Protocol (SIP) conversation. The vulnerability is due to the improper validation of server certificates. An attacker could exploit this vulnerability by crafting a malicious server certificate to present to the client. An exploit could allow an attacker to eavesdrop on TLS-encrypted traffic and potentially route or redirect calls initiated by an affected device. Affected software include version 7.6.2 of the Cisco Small Business SPA525 Series IP Phones and Cisco Small Business SPA5X5 Series IP Phones and version 1.4.2 of the Cisco Small Business SPA500 Series IP Phones and Cisco Small Business SPA112 Series IP Phones.

Affected products and versions

cisco spa112_firmware
cisco spa500_firmware
cisco spa500ds_firmware
cisco spa500s_firmware
cisco spa501g_firmware
cisco spa502g_firmware
cisco spa504g_firmware
cisco spa508g_firmware
cisco spa509g_firmware
cisco spa512g_firmware
cisco spa514g_firmware
cisco spa525_firmware
cisco spa525g_firmware
cisco spa5x5_firmware

Analysis

This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.

References