A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to modify a web page in the context of a user's browser.

This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to alter the contents of a web page to redirect the user to potentially malicious websites, or the attacker could use this vulnerability to conduct further client-side attacks.

Cisco will not release software updates that address this vulnerability.

{{value}} ["%7b%7bvalue%7d%7d"])}]]

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00102.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco Small Business IP Phones affected
Version Status Constraints
7.6.0 affected —
7.6.2 affected —
7.6.2SR3 affected —
7.6.2SR6 affected —
7.6.2SR2 affected —
7.6.2SR4 affected —
7.6.2SR1 affected —
7.6.2SR5 affected —
7.6.2SR7 affected —
7.6.1 affected —
7.3.7 affected —
7.5.5 affected —
7.5.6(XU) affected —
7.5.2 affected —
7.5.2a affected —
7.5.7 affected —
7.5.3 affected —
7.5.6 affected —
7.5.2b affected —
7.5.6c affected —
7.5.6a affected —
7.5.7s affected —
7.5.1 affected —
7.5.5a affected —
7.5.5b affected —
7.5.4 affected —
7.4.7 affected —
7.4.4 affected —
7.4.8 affected —
7.4.3 affected —
7.4.9 affected —
7.4.6 affected —

Configuration 1 [-]

AND
cpe:2.3:o:cisco:spa500ds_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa500ds:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:o:cisco:spa500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa500s:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND
cpe:2.3:o:cisco:spa501g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa501g:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND
cpe:2.3:o:cisco:spa502g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa502g:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND
cpe:2.3:o:cisco:spa504g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa504g:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND
cpe:2.3:o:cisco:spa508g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa508g:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND
cpe:2.3:o:cisco:spa509g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa509g:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND
cpe:2.3:o:cisco:spa512g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa512g:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND
cpe:2.3:o:cisco:spa514g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa514g:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND
cpe:2.3:o:cisco:spa525_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa525:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND
cpe:2.3:o:cisco:spa525g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa525g:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND
cpe:2.3:o:cisco:spa525g2_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa525g2:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Cisco Subscribe
Spa500ds Subscribe
Spa500ds Firmware Subscribe
Spa500s Subscribe
Spa500s Firmware Subscribe
Spa501g Subscribe
Spa501g Firmware Subscribe
Spa502g Subscribe
Spa502g Firmware Subscribe
Spa504g Subscribe
Spa504g Firmware Subscribe
Spa508g Subscribe
Spa508g Firmware Subscribe
Spa509g Subscribe
Spa509g Firmware Subscribe
Spa512g Subscribe
Spa512g Firmware Subscribe
Spa514g Subscribe
Spa514g Firmware Subscribe
Spa525 Subscribe
Spa525 Firmware Subscribe
Spa525g Subscribe
Spa525g2 Subscribe
Spa525g2 Firmware Subscribe
Spa525g Firmware Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-24397 A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to modify a web page in the context of a user's browser. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to alter the contents of a web page to redirect the user to potentially malicious websites, or the attacker could use this vulnerability to conduct further client-side attacks. Cisco will not release software updates that address this vulnerability. {{value}} ["%7b%7bvalue%7d%7d"])}]]
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-web-multi-7kvPmu2F cve-icon cve-icon
History

Thu, 17 Oct 2024 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2024-10-17T14:59:14.948Z

Reserved: 2022-10-27T18:47:50.368Z

Link: CVE-2023-20218

cve-icon Vulnrichment

Updated: 2024-08-02T09:05:36.868Z

cve-icon NVD

Status : Modified

Published: 2023-08-03T22:15:11.770

Modified: 2024-11-21T07:40:55.383

Link: CVE-2023-20218

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses