CVE-2019-1923

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by accessing the configuration interface, which may require a password, and then accessing the device's physical interface and inserting a USB storage device. A successful exploit could allow the attacker to execute arbitrary commands on the device in an elevated security context. At the time of publication, this vulnerability affected Cisco Small Business SPA500 Series IP Phones firmware releases 7.6.2SR5 and prior.

• CWE-77
• CWE-20

• http://www.securityfocus.com/bid/109294Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-spa500-commandVendor Advisory
• http://www.securityfocus.com/bid/109294Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-spa500-commandVendor Advisory

Published

Jul 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19224A Broken Access Control vulnerability in the D-Link DSL-2680…7.5
• CVE-2019-19225A Broken Access Control vulnerability in the D-Link DSL-2680…7.5
• CVE-2019-19226A Broken Access Control vulnerability in the D-Link DSL-2680…7.5
• CVE-2019-19227In the AppleTalk subsystem in the Linux kernel before 5.1, t…5.5
• CVE-2019-19228Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) all…9.8
• CVE-2019-19229admincgi-bin/service.fcgi on Fronius Solar Inverter devices …6.5
• CVE-2019-19230An unsafe deserialization vulnerability exists in CA Release…9.8
• CVE-2019-19231An insecure file access vulnerability exists in CA Client Au…7.8
• CVE-2019-19232In Sudo through 1.8.29, an attacker with access to a Runas A…7.5
• CVE-2019-19234In Sudo through 1.8.29, the fact that a user has been blocke…7.5
• CVE-2019-19235AsLdrSrv.exe in ASUS ATK Package before V1.0.0061 (for Windo…7
• CVE-2019-1924Multiple vulnerabilities in Cisco Webex Network Recording Pl…7.8