Description
A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. A successful exploit could allow the attacker to execute arbitrary code on the affected device with full privileges. Cisco has not released firmware updates to address this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cisco | Cisco Small Business IP Phones | — | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
fullspectrumdev/RancidCrisco ★ 24 · May 17, 2023
PoC for CVE-2023-20126
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2023-1138 Cisco SPA112 2-Port Phone Adapter: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · May 3, 2023