CVE-2019-1923

Name: CVE-2019-1923
Creator: NVD / NIST
Published: 2019-07-17T21:15:12.17+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.6/10EPSS 0.47%

Last modified Jun 17, 2026

CVE-2019-1923 is a medium-severity vulnerability rated 6.6/10 on the CVSS scale. A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. EPSS estimates a 0.47% chance of exploitation in the next 30 days.

Description

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by accessing the configuration interface, which may require a password, and then accessing the device's physical interface and inserting a USB storage device. A successful exploit could allow the attacker to execute arbitrary commands on the device in an elevated security context. At the time of publication, this vulnerability affected Cisco Small Business SPA500 Series IP Phones firmware releases 7.6.2SR5 and prior.

Metrics

CVSS 3.1

6.6/10

CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.47%

37.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Cisco	Spa501g Firmware	<= 7.6.2sr5
Cisco	Spa502g Firmware	<= 7.6.2sr5
Cisco	Spa504g Firmware	<= 7.6.2sr5
Cisco	Spa508g Firmware	<= 7.6.2sr5
Cisco	Spa509g Firmware	<= 7.6.2sr5
Cisco	Spa512g Firmware	<= 7.6.2sr5
Cisco	Spa514g Firmware	<= 7.6.2sr5
Cisco	Spa525g2 Firmware	<= 7.6.2sr5
Cisco	Spa500s Firmware	<= 7.6.2sr5
Cisco	Spa500ds Firmware	<= 7.6.2sr5

References

http://www.securityfocus.com/bid/109294Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-spa500-commandVendor Advisory
http://www.securityfocus.com/bid/109294Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-spa500-commandVendor Advisory

Timeline

Published: Jul 17, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-1923?

How severe is CVE-2019-1923?

CVE-2019-1923 has a CVSS score of 6.6/10 (MEDIUM severity). The EPSS model estimates a 0.47% probability of exploitation in the next 30 days.

How do I fix CVE-2019-1923?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-1923?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST