CVE-2023-20218: XSS
First published: Thu Aug 03 2023(Updated: )
A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to modify a web page in the context of a user's browser. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to alter the contents of a web page to redirect the user to potentially malicious websites, or the attacker could use this vulnerability to conduct further client-side attacks. Cisco will not release software updates that address this vulnerability. {{value}} ["%7b%7bvalue%7d%7d"])}]]
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco SPA 500DS Firmware | ||
| Cisco SPA 500 DS | ||
| Cisco SPA 500s Firmware | ||
| Cisco SPA 500 | ||
| Cisco SPA 501G Firmware | ||
| Cisco SPA 501G Firmware | ||
| Quectel RG502Q-EA Firmware | ||
| Cisco SPA 502G Firmware | ||
| Cisco SPA504G | ||
| Cisco SPA 500 Series | ||
| Cisco SPA508G Firmware | ||
| Cisco SPA 508G | ||
| Cisco SPA 509g firmware | ||
| Cisco SPA 509G | ||
| Cisco SPA 512G Firmware | ||
| Cisco SPA 512G Firmware | ||
| Cisco SPA514G | ||
| Cisco SPA 514G Firmware | ||
| Cisco SPA 525G2 Firmware | ||
| Cisco SPA 525g | ||
| Cisco SPA 525g firmware | ||
| Cisco SPA 525G2 Firmware | ||
| Cisco SPA 525G2 Firmware | ||
| Cisco SPA 525g2 5-line IP Phone | ||
| All of | ||
| Cisco SPA 500DS Firmware | ||
| Cisco SPA 500 DS | ||
| All of | ||
| Cisco SPA 500s Firmware | ||
| Cisco SPA 500 | ||
| All of | ||
| Cisco SPA 501G Firmware | ||
| Cisco SPA 501G Firmware | ||
| All of | ||
| Quectel RG502Q-EA Firmware | ||
| Cisco SPA 502G Firmware | ||
| All of | ||
| Cisco SPA504G | ||
| Cisco SPA 500 Series | ||
| All of | ||
| Cisco SPA508G Firmware | ||
| Cisco SPA 508G | ||
| All of | ||
| Cisco SPA 509g firmware | ||
| Cisco SPA 509G | ||
| All of | ||
| Cisco SPA 512G Firmware | ||
| Cisco SPA 512G Firmware | ||
| All of | ||
| Cisco SPA514G | ||
| Cisco SPA 514G Firmware | ||
| All of | ||
| Cisco SPA 525G2 Firmware | ||
| Cisco SPA 525g | ||
| All of | ||
| Cisco SPA 525g firmware | ||
| Cisco SPA 525G2 Firmware | ||
| All of | ||
| Cisco SPA 525G2 Firmware | ||
| Cisco SPA 525g2 5-line IP Phone |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-20218.
What is the severity of CVE-2023-20218?
The severity of CVE-2023-20218 is medium.
How does the vulnerability affect Cisco SPA500 Series Analog Telephone Adapters (ATAs)?
The vulnerability allows an authenticated, remote attacker to modify a web page in the context of a user's browser.
Is there a fix available for CVE-2023-20218?
Yes, Cisco has provided a fix for this vulnerability. Please refer to the Cisco Security Advisory for more information.
What is the Common Weakness Enumeration (CWE) number associated with CVE-2023-20218?
The CWE number associated with CVE-2023-20218 is CWE-79.
- collector/nvd-latest
- agent/type
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco spa 500ds firmware
- canonical/cisco spa 500 ds
- canonical/cisco spa 500s firmware
- canonical/cisco spa 500
- canonical/cisco spa 501g firmware
- canonical/quectel rg502q-ea firmware
- canonical/cisco spa 502g firmware
- canonical/cisco spa504g
- canonical/cisco spa 500 series
- canonical/cisco spa508g firmware
- canonical/cisco spa 508g
- canonical/cisco spa 509g firmware
- canonical/cisco spa 509g
- canonical/cisco spa 512g firmware
- canonical/cisco spa514g
- canonical/cisco spa 514g firmware
- canonical/cisco spa 525g2 firmware
- canonical/cisco spa 525g
- canonical/cisco spa 525g firmware
- canonical/cisco spa 525g2 5-line ip phone