CVE-2019-1683
Summary
| CVE | CVE-2019-1683 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-02-25 17:29:00 UTC |
| Updated | 2023-03-23 17:34:00 UTC |
| Description | A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security (TLS)-encrypted Session Initiation Protocol (SIP) conversation. The vulnerability is due to the improper validation of server certificates. An attacker could exploit this vulnerability by crafting a malicious server certificate to present to the client. An exploit could allow an attacker to eavesdrop on TLS-encrypted traffic and potentially route or redirect calls initiated by an affected device. Affected software include version 7.6.2 of the Cisco Small Business SPA525 Series IP Phones and Cisco Small Business SPA5X5 Series IP Phones and version 1.4.2 of the Cisco Small Business SPA500 Series IP Phones and Cisco Small Business SPA112 Series IP Phones. |
Risk And Classification
Problem Types: CWE-295
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Cisco | Spa112 | - | All | All | All |
| Hardware | Cisco | Spa112 | - | All | All | All |
| Operating System | Cisco | Spa112 Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa112 Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa500 | - | All | All | All |
| Operating System | Cisco | Spa500 | - | All | All | All |
| Hardware | Cisco | Spa500ds | - | All | All | All |
| Hardware | Cisco | Spa500ds | - | All | All | All |
| Operating System | Cisco | Spa500ds Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa500ds Firmware | 1.4.2 | All | All | All |
| Hardware | Cisco | Spa500s | - | All | All | All |
| Hardware | Cisco | Spa500s | - | All | All | All |
| Operating System | Cisco | Spa500s Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa500s Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa500 Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa500 Firmware | 1.4.2 | All | All | All |
| Hardware | Cisco | Spa501g | - | All | All | All |
| Hardware | Cisco | Spa501g | - | All | All | All |
| Operating System | Cisco | Spa501g Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa501g Firmware | 1.4.2 | All | All | All |
| Hardware | Cisco | Spa502g | - | All | All | All |
| Hardware | Cisco | Spa502g | - | All | All | All |
| Operating System | Cisco | Spa502g Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa502g Firmware | 1.4.2 | All | All | All |
| Hardware | Cisco | Spa504g | - | All | All | All |
| Hardware | Cisco | Spa504g | - | All | All | All |
| Operating System | Cisco | Spa504g Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa504g Firmware | 1.4.2 | All | All | All |
| Hardware | Cisco | Spa508g | - | All | All | All |
| Hardware | Cisco | Spa508g | - | All | All | All |
| Operating System | Cisco | Spa508g Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa508g Firmware | 1.4.2 | All | All | All |
| Hardware | Cisco | Spa509g | - | All | All | All |
| Hardware | Cisco | Spa509g | - | All | All | All |
| Operating System | Cisco | Spa509g Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa509g Firmware | 1.4.2 | All | All | All |
| Hardware | Cisco | Spa512g | - | All | All | All |
| Hardware | Cisco | Spa512g | - | All | All | All |
| Operating System | Cisco | Spa512g Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa512g Firmware | 1.4.2 | All | All | All |
| Hardware | Cisco | Spa514g | - | All | All | All |
| Hardware | Cisco | Spa514g | - | All | All | All |
| Operating System | Cisco | Spa514g Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa514g Firmware | 1.4.2 | All | All | All |
| Hardware | Cisco | Spa525 | - | All | All | All |
| Hardware | Cisco | Spa525 | - | All | All | All |
| Hardware | Cisco | Spa525g | - | All | All | All |
| Hardware | Cisco | Spa525g | - | All | All | All |
| Operating System | Cisco | Spa525g Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa525g Firmware | 1.4.2 | All | All | All |
| Operating System | Cisco | Spa525 Firmware | 7.6.2 | All | All | All |
| Operating System | Cisco | Spa525 Firmware | 7.6.2 | All | All | All |
| Hardware | Cisco | Spa5x5 | - | All | All | All |
| Hardware | Cisco | Spa5x5 | - | All | All | All |
| Operating System | Cisco | Spa5x5 Firmware | 7.6.2 | All | All | All |
| Operating System | Cisco | Spa5x5 Firmware | 7.6.2 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cisco SPA112, SPA525, and SPA5x5 Series IP Phones Certificate Validation Vulnerability | CISCO | tools.cisco.com | Vendor Advisory |
| Malformed Request | BID | www.securityfocus.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.