Cisco disclosed a vulnerability in the web-based management interface of the Cisco SPA112 2-Port Phone Adapters, which allows an unauthorized, remote intruder to execute arbitrary code on the devices.
Named CVE-2023-20126 and with a CVSS “critical” 9,8, this vulnerability is caused by an incomplete authentication process within the firmware upgrade operation.
See also: Cisco discloses XSS zero-day vulnerability in server management tool
"An attacker could exploit this vulnerability by upgrading an affected device to a modified firmware version," Cisco's security bulletin states
“A successful exploitation could allow the attacker to execute arbitrary code on the affected device with full privileges.”
These telephone adapters are a popular choice in the industry for integrating analog phones into VoIP without upgrading.
While these adapters may be used in many organizations, they are likely not exposed to the internet, making these flaws exploitable primarily from the local network.
However, gaining access to these devices could help a hacker spread laterally across a network without being detected, as security software typically does not monitor these types of devices.
Suggestion: Mirai malware exploits vulnerability in TP-Link Archer WiFi router
Given that the Cisco SPA112 has reached its end of life, it is no longer supported by the vendor and will not receive security updates. Additionally, Cisco has not provided mitigations for CVE-2023-20126.
Cisco's security advisory aims to raise awareness about the need to replace the affected telephone adapters or to implement additional security layers to protect them from attacks.
The recommended replacement model is the analog telephone adapter Cisco ATA 190 Series, which has an end-of-life date set for March 31, 2024.
The company is not aware of any active exploitation of CVE-2023-20126 in the market, but this could change at any time, so administrators are urged to urgently take appropriate precautions.
Critical severity flaws in once-popular devices are potential candidates for use in attacks, possibly leading to large-scale security incidents.
Read also: QNAP: Warns of Linux Sudo vulnerability in NAS devices
source of information:bleepingcomputer.com
