CVE-2019-1683

A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security (TLS)-encrypted Session Initiation Protocol (SIP) conversation. The vulnerability is due to the improper validation of server certificates. An attacker could exploit this vulnerability by crafting a malicious server certificate to present to the client. An exploit could allow an attacker to eavesdrop on TLS-encrypted traffic and potentially route or redirect calls initiated by an affected device. Affected software include version 7.6.2 of the Cisco Small Business SPA525 Series IP Phones and Cisco Small Business SPA5X5 Series IP Phones and version 1.4.2 of the Cisco Small Business SPA500 Series IP Phones and Cisco Small Business SPA112 Series IP Phones.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:cisco:spa112_firmware:1.4.2:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa112:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:cisco:spa525_firmware:7.6.2:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa525:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:cisco:spa5x5_firmware:7.6.2:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa5x5:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:cisco:spa500_firmware:1.4.2:*:*:*:*:*:*:*
cpe:2.3:o:cisco:spa500:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:cisco:spa500s_firmware:1.4.2:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa500s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:cisco:spa500ds_firmware:1.4.2:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa500ds:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:cisco:spa501g_firmware:1.4.2:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa501g:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:cisco:spa502g_firmware:1.4.2:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa502g:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:cisco:spa504g_firmware:1.4.2:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa504g:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:cisco:spa508g_firmware:1.4.2:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa508g:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:cisco:spa509g_firmware:1.4.2:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa509g:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:cisco:spa512g_firmware:1.4.2:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa512g:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:cisco:spa514g_firmware:1.4.2:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa514g:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:cisco:spa525g_firmware:1.4.2:*:*:*:*:*:*:*
cpe:2.3:h:cisco:spa525g:-:*:*:*:*:*:*:*

History

23 Mar 2023, 17:34

Type Values Removed Values Added
References (BID) http://www.securityfocus.com/bid/107111 - Third Party Advisory (BID) http://www.securityfocus.com/bid/107111 - Broken Link, Third Party Advisory, VDB Entry

Information

Published : 2019-02-25 17:29

Updated : 2023-12-10 12:44


NVD link : CVE-2019-1683

Mitre link : CVE-2019-1683

CVE.ORG link : CVE-2019-1683


JSON object : View

Products Affected

cisco

  • spa509g
  • spa514g_firmware
  • spa112_firmware
  • spa512g_firmware
  • spa502g_firmware
  • spa112
  • spa504g
  • spa525_firmware
  • spa500ds_firmware
  • spa502g
  • spa509g_firmware
  • spa500s_firmware
  • spa525
  • spa500s
  • spa512g
  • spa504g_firmware
  • spa5x5
  • spa5x5_firmware
  • spa508g_firmware
  • spa501g
  • spa500
  • spa508g
  • spa500_firmware
  • spa501g_firmware
  • spa514g
  • spa500ds
  • spa525g_firmware
  • spa525g
CWE
CWE-295

Improper Certificate Validation