Vulnerability · Published Sep 24, 2026 · Assigned by VulDB

CVE-2026-96774SPON Communications IP Network Audio Device XC-9603 Configuration File Download sys_cfg.txt loadCfg information disclosure

Medium 5.3

In plain English

A medium-severity information exposure in IP Network Audio Device XC-9603 from SPON Communications. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 78.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. This affects the function loadCfg of the file /ini/sys_cfg.txt of the component Configuration File Download. The manipulation results in information disclosure. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
SPON Communications	IP Network Audio Device XC-9603	1.2.3_20181106 Build 107

Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R

References

VDB-409033 | SPON Communications IP Network Audio Device XC-9603 Configuration File Download sys_cfg.txt loadCfg information disclosure vdb-entry, technical-description
VDB-409033 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-96774 | CVE Analysis and Report third-party-advisory
Submit #904898 | SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107 Information Exposure third-party-advisory