Cisco SPA500DS Firmware vulnerabilities

4 CVEs affecting Cisco SPA500DS Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-20218, published 2023-08-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-1683, published 2019-02-25. High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of…
CVE-2023-20181, published 2023-08-03. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conduct XSS attacks. This vulnerability is due…
CVE-2019-1923, published 2019-07-17. Medium severity, CVSS 6.6. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input…
CVE-2023-20218, published 2023-08-03. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to modify a web page in the context of a…