CVE-2019-15959
Cisco Small Business SPA500 Series IP Phones Local Script Execution Vulnerability
- State
- Published
- Severity
- 6.6 Medium
- Published
- Sep 23, 2020
- Updated
- Nov 13, 2024
- Reserved
- Sep 6, 2019
Description
A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit this vulnerability by accessing the physical interface of a device and inserting a USB storage device. A successful exploit could allow the attacker to execute scripts on the device in an elevated security context.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 6.6 Medium | CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | cisco |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Cisco SPA525G2 5-line IP PhoneCisco |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.