cisco-sa-20190807-spa112-xss: Cisco SPA112 2-Port Phone Adapter Stored Cross-Site Scripting Vulnerability
First published: Wed Aug 07 2019(Updated: )
A vulnerability in the web-based interface of the Cisco SPA112 2-Port Phone Adapter could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against another user of the device. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by inserting malicious code in one of the configuration fields. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-spa112-xss
Credit: Samuel Dugo Ryanair
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco SPA112 2-Port Phone Adapter Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of Cisco SA 20190807 SPA112 XSS?
The severity of Cisco SA 20190807 SPA112 XSS is rated as high due to the potential for attackers to execute cross-site scripting attacks.
How do I fix Cisco SA 20190807 SPA112 XSS?
To fix Cisco SA 20190807 SPA112 XSS, update the Cisco SPA112 2-Port Phone Adapter to the latest firmware provided by Cisco.
Who is affected by Cisco SA 20190807 SPA112 XSS?
Users of the Cisco SPA112 2-Port Phone Adapter are affected by the Cisco SA 20190807 SPA112 XSS vulnerability.
What type of attack is associated with Cisco SA 20190807 SPA112 XSS?
The Cisco SA 20190807 SPA112 XSS vulnerability allows for cross-site scripting attacks that target users of the device's web interface.
Is authentication required for exploiting Cisco SA 20190807 SPA112 XSS?
Yes, authentication is required for an attacker to exploit the Cisco SA 20190807 SPA112 XSS vulnerability.
- agent/type
- agent/event
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/last-modified-date
- agent/severity
- agent/title
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco spa112 2-port phone adapter firmware