CVE-2019-1683
Cisco SPA112, SPA525, and SPA5x5 Series IP Phones Certificate Validation Vulnerability
- Published
- Updated
- Reserved
- Assigned by
- cisco
Description
A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security (TLS)-encrypted Session Initiation Protocol (SIP) conversation. The vulnerability is due to the improper validation of server certificates. An attacker could exploit this vulnerability by crafting a malicious server certificate to present to the client. An exploit could allow an attacker to eavesdrop on TLS-encrypted traffic and potentially route or redirect calls initiated by an affected device. Affected software include version 7.6.2 of the Cisco Small Business SPA525 Series IP Phones and Cisco Small Business SPA5X5 Series IP Phones and version 1.4.2 of the Cisco Small Business SPA500 Series IP Phones and Cisco Small Business SPA112 Series IP Phones.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ciscoCNA (assigner) | 3.0 | Medium6.5 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N |
| NVDNVD · Modified | 3.1 | High7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.87% · top 41% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
Affected products
Cisco · Cisco Small Business SPA500 Series IP Phones
- affected 1.4.2
Cisco · Cisco Small Business SPA112 Series IP Phones
- affected 1.4.2
Cisco · Cisco Small Business SPA525 Series IP Phones
- affected 7.6.2
Cisco · Cisco Small Business SPA5X5 Series IP Phones
- affected 7.6.2
What to do
Exploitation: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
References (2)
- 20190220 Cisco SPA112, SPA525, and SPA5x5 Series IP Phones Certificate Validation Vulnerability (opens in a new tab)vendor-advisoryx_refsource_CISCOx_transferred
- 107111 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-1683)Record last updated .