The remote Cisco SPA100 Series device is affected by multiple vulnerabilities:

  - Multiple remote code execution vulnerabilities. An authenticated attacker can cause a stack overflow leading to     control flow change in the Cisco SPA 112/122 device. (CVE-2019-15240, CVE-2019-15241, CVE-2019-15242,     CVE-2019-15243, CVE-2019-15244, CVE-2019-15245, CVE-2019-15246, CVE-2019-15247, CVE-2019-15248, CVE-2019-15249,     CVE-2019-15250, CVE-2019-15251, CVE-2019-15252)

  - Multiple cross-site scripting vulnerabilities. An authenticated attacker can inject javascript on the Cisco SPA     112/122 device. (CVE-2019-12702, CVE-2019-12703)

  - An arbitrary file disclosure vulnerability. An unauthenticated attacker can read any file on the device and     elevate local privilege. (CVE-2019-12704)

  - Multiple privilege escalation vulnerabilites. An authenticated attacker can leak the administrator password     hash to escalate local privilege. (CVE-2019-12708, CVE-2019-15257)

  - A denial of service vulnerability. An authenticated attacker can crash the web service with a malformed     request. (CVE-2019-12258)

Detections

Analytics

Cisco SPA100 Series Multiple Vulnerabilities

high Nessus Plugin ID 129982

Version 1.8

Version 1.7

Version 1.8 Oct 2, 2024, 4:10 PM Logic Changes (Adds structured data reports to a subset of manual plugins.) Plugin Feed: 202410021610
Version 1.7 Apr 18, 2024, 3:14 PM Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True") Plugin Feed: 202404181514