Vulnerability · Published May 4, 2023 · Assigned by cisco
CVE-2023-20126Cisco SPA112 2-Port Phone Adapters Remote Command Execution Vulnerability
Critical 9.8
In plain English
A critical-severity missing authentication in Cisco Small Business IP Phones from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 36.7% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. A successful exploit could allow the attacker to execute arbitrary code on the affected device with full privileges. Cisco has not released firmware updates to address this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Small Business IP Phones | n/a |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H