Cisco this week raised the alarm on a critical remote code execution (RCE) vulnerability impacting SPA112 2-Port phone adapters, which have reached end-of-life (EoL) status.
Tracked as CVE-2023-20126 (CVSS score of 9.8), the flaw impacts the web-based management interface of the phone adapters and can be exploited without authentication.
The issue, Cisco explains in its advisory, exists because of “a missing authentication process within the firmware upgrade function”.
To exploit the bug, a remote attacker needs to upgrade a device to a crafted firmware version, which would allow them to execute arbitrary code with full privileges.
Given that the SPA112 2-Port phone adapters are no longer supported (they reached EoL on June 1, 2020), Cisco does not plan to release firmware updates to address the vulnerability.
Instead, the tech giant recommends that customers migrate to an ATA 190 Series analog telephone adapter.
Cisco says it is not aware of the vulnerability being exploited in malicious attacks. However, unpatched, vulnerable Cisco devices are known to have been exploited in the wild and organizations should consider eliminating the SPA112 2-Port phone adapters from their environments as soon as possible.
Related: Cisco Working on Patch for Vulnerability Reported by NATO Pentester
Related: Cisco Patches Critical Vulnerabilities in Industrial Network Director, Modeling Labs
Related: US, UK: Russia Exploiting Old Vulnerability to Hack Cisco Routers
Related: Cisco Patches Code and Command Execution Vulnerabilities in Several Products
More from Ionut Arghire
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Enzo Biochem Ransomware Attack Exposes Information of 2.5M Individuals
- Google Temporarily Offering $180,000 for Full Chain Chrome Exploit
- Toyota Discloses New Data Breach Involving Vehicle, Customer Information
- Adobe Inviting Researchers to Private Bug Bounty Program
- Critical Vulnerabilities Found in Faronics Education Software
Latest News
- Insider Q&A: Artificial Intelligence and Cybersecurity In Military Tech
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- OpenAI Unveils Million-Dollar Cybersecurity Grant Program
- Galvanick Banks $10 Million for Industrial XDR Technology
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Idaho Hospitals Working to Resume Full Operations After Cyberattack
