CVE-2019-15959 : A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute a

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit this vulnerability by accessing the physical interface of a device and inserting a USB storage device. A successful exploit could allow the attacker to execute scripts on the device in an elevated security context.

Published 2020-09-23 01:15:13

Updated 2020-10-08 14:38:14

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Input validation

Exploit prediction scoring system (EPSS) score for CVE-2019-15959

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 10 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-15959

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
6.6	MEDIUM	CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	0.7	5.9	Cisco Systems, Inc.
Attack Vector: Physical Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.6	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	0.7	5.9	NIST
Attack Vector: Physical Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-15959

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by:

nvd@nist.gov (Primary)
ykramarz@cisco.com (Secondary)

Products affected by CVE-2019-15959

Cisco » Spa500 Series Ip Phones Firmware
Versions up to, including, (<=) 7.5.7\(5\)
cpe:2.3:o:cisco:spa500_series_ip_phones_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Spa500ds » Version: N/A
When used together with: Cisco » Spa500s » Version: N/A
When used together with: Cisco » Spa501g » Version: N/A
When used together with: Cisco » Spa502g » Version: N/A
When used together with: Cisco » Spa504g » Version: N/A
When used together with: Cisco » Spa512g » Version: N/A
When used together with: Cisco » Spa514g » Version: N/A
When used together with: Cisco » Spa525g » Version: N/A
When used together with: Cisco » Spa525g2 » Version: N/A

Vulnerability Details : CVE-2019-15959

Exploit prediction scoring system (EPSS) score for CVE-2019-15959

CVSS scores for CVE-2019-15959

CWE ids for CVE-2019-15959

References for CVE-2019-15959

Products affected by CVE-2019-15959