CVE-2023-20181: XSS
First published: Thu Aug 03 2023(Updated: )
A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conduct XSS attacks. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco SPA 500DS Firmware | ||
| Cisco SPA 500 DS | ||
| Cisco SPA 500s Firmware | ||
| Cisco SPA 500 | ||
| Cisco SPA 501G Firmware | ||
| Cisco SPA 501G Firmware | ||
| Quectel RG502Q-EA Firmware | ||
| Cisco SPA 502G Firmware | ||
| Cisco SPA504G | ||
| Cisco SPA 500 Series | ||
| Cisco SPA508G Firmware | ||
| Cisco SPA 508G | ||
| Cisco SPA 509g firmware | ||
| Cisco SPA 509G | ||
| Cisco SPA 512G Firmware | ||
| Cisco SPA 512G Firmware | ||
| Cisco SPA514G | ||
| Cisco SPA 514G Firmware | ||
| Cisco SPA 525G2 Firmware | ||
| Cisco SPA 525g | ||
| Cisco SPA 525g firmware | ||
| Cisco SPA 525G2 Firmware | ||
| Cisco SPA 525G2 Firmware | ||
| Cisco SPA 525g2 5-line IP Phone | ||
| All of | ||
| Cisco SPA 500DS Firmware | ||
| Cisco SPA 500 DS | ||
| All of | ||
| Cisco SPA 500s Firmware | ||
| Cisco SPA 500 | ||
| All of | ||
| Cisco SPA 501G Firmware | ||
| Cisco SPA 501G Firmware | ||
| All of | ||
| Quectel RG502Q-EA Firmware | ||
| Cisco SPA 502G Firmware | ||
| All of | ||
| Cisco SPA504G | ||
| Cisco SPA 500 Series | ||
| All of | ||
| Cisco SPA508G Firmware | ||
| Cisco SPA 508G | ||
| All of | ||
| Cisco SPA 509g firmware | ||
| Cisco SPA 509G | ||
| All of | ||
| Cisco SPA 512G Firmware | ||
| Cisco SPA 512G Firmware | ||
| All of | ||
| Cisco SPA514G | ||
| Cisco SPA 514G Firmware | ||
| All of | ||
| Cisco SPA 525G2 Firmware | ||
| Cisco SPA 525g | ||
| All of | ||
| Cisco SPA 525g firmware | ||
| Cisco SPA 525G2 Firmware | ||
| All of | ||
| Cisco SPA 525G2 Firmware | ||
| Cisco SPA 525g2 5-line IP Phone |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-20181?
CVE-2023-20181 is a vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones.
How severe is CVE-2023-20181?
CVE-2023-20181 has a severity value of 6.1, which is categorized as medium.
How does CVE-2023-20181 affect Cisco Small Business SPA500 Series IP Phones?
CVE-2023-20181 allows an unauthenticated, remote attacker to conduct XSS attacks on Cisco Small Business SPA500 Series IP Phones.
What is the Common Weakness Enumeration (CWE) ID for CVE-2023-20181?
The CWE ID for CVE-2023-20181 is 79.
How can I fix CVE-2023-20181?
To fix CVE-2023-20181, Cisco has released a security advisory that provides steps to mitigate the vulnerability. Please refer to the Cisco Security Advisory for more information.
- collector/nvd-latest
- agent/type
- agent/severity
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco spa 500ds firmware
- canonical/cisco spa 500 ds
- canonical/cisco spa 500s firmware
- canonical/cisco spa 500
- canonical/cisco spa 501g firmware
- canonical/quectel rg502q-ea firmware
- canonical/cisco spa 502g firmware
- canonical/cisco spa504g
- canonical/cisco spa 500 series
- canonical/cisco spa508g firmware
- canonical/cisco spa 508g
- canonical/cisco spa 509g firmware
- canonical/cisco spa 509g
- canonical/cisco spa 512g firmware
- canonical/cisco spa514g
- canonical/cisco spa 514g firmware
- canonical/cisco spa 525g2 firmware
- canonical/cisco spa 525g
- canonical/cisco spa 525g firmware
- canonical/cisco spa 525g2 5-line ip phone