CVE-2019-15243 (CNNVD-201910-1120)
中文标题:
Cisco SPA100 Series Analog Telephone Adapters 缓冲区错误漏洞
英文标题:
Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities
漏洞描述
中文描述:
Cisco SPA100 Series Analog Telephone Adapters（ATAs）是美国思科（Cisco）公司的一款SPA100系列模拟电话适配器。 Cisco SPA100 Series ATAs中存在缓冲区错误漏洞，该漏洞源于程序没有正确验证用户提交的输入。攻击者可通过对该管理界面进行身份验证并发送特制的请求利用该漏洞以提升的权限执行任意代码。
英文描述:
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco SPA112 2-Port Phone Adapter | - | < n/a | - |
cpe:2.3:a:cisco:cisco_spa112_2-port_phone_adapter:*:*:*:*:*:*:*:*
|
| cisco | spa112_firmware | * | - | - |
cpe:2.3:o:cisco:spa112_firmware:*:*:*:*:*:*:*:*
|
| cisco | spa112_firmware | 1.4.1 | - | - |
cpe:2.3:o:cisco:spa112_firmware:1.4.1:-:*:*:*:*:*:*
|
| cisco | spa122_firmware | * | - | - |
cpe:2.3:o:cisco:spa122_firmware:*:*:*:*:*:*:*:*
|
| cisco | spa122_firmware | 1.4.1 | - | - |
cpe:2.3:o:cisco:spa122_firmware:1.4.1:-:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.0 (cna)
HIGHCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2019-15243 |
2025-11-11 15:20:03 | 2025-11-11 07:35:35 |
| NVD | nvd_CVE-2019-15243 |
2025-11-11 14:56:28 | 2025-11-11 07:44:07 |
| CNNVD | cnnvd_CNNVD-201910-1120 |
2025-11-11 15:10:18 | 2025-11-11 07:54:58 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 缓冲区错误
- cnnvd_id: 未提取 -> CNNVD-201910-1120
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 5
- data_sources: ['cve'] -> ['cve', 'nvd']