CVE-2019-1956— Cisco SPA112 2-Port Phone Adapter Stored Cross-Site Scripting Vulnerability
Quick assessment
Affected
Cisco Cisco SPA112 2-Port Phone Adapter
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco SPA112 2-Port Phone Adapter是美国思科（Cisco）公司的一款电话适配器。 使用1.4.1SR4之前版本固件的Cisco SPA112 2-Port Phone Adapter中存在跨站脚本漏洞，该漏洞源于程序没有充分验证用户提交的输入。远程攻击者可通过在配置字段中插入恶意代码利用该漏洞执行任意脚本代码或访问基于浏览器的敏感信息。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-1956
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco SPA112 2-Port Phone Adapter Stored Cross-Site Scripting Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the web-based interface of the Cisco SPA112 2-Port Phone Adapter could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against another user of the device. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by inserting malicious code in one of the configuration fields. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco SPA112 2-Port Phone Adapter 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco SPA112 2-Port Phone Adapter是美国思科（Cisco）公司的一款电话适配器。 使用1.4.1SR4之前版本固件的Cisco SPA112 2-Port Phone Adapter中存在跨站脚本漏洞，该漏洞源于程序没有充分验证用户提交的输入。远程攻击者可通过在配置字段中插入恶意代码利用该漏洞执行任意脚本代码或访问基于浏览器的敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco SPA112 2-Port Phone Adapter | unspecified ~ n/a | - |
|
II. Public POCs for CVE-2019-1956
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-1956
请登录查看更多情报信息。
Vendor Advisories for CVE-2019-1956 (1)
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-spa112-xss vendor-advisory x_refsource_CISCO
Same Patch Batch · Cisco · 2019-08-08 · 17 CVEs total
| CVE-2019-1973 | Cisco Enterprise NFV Infrastructure Software Cross-site Scripting Vulnerability | |
| CVE-2019-1959 | Cisco Enterprise NFV Infrastructure Software Arbitrary File Read Vulnerabilities | |
| CVE-2019-1960 | Cisco Enterprise NFV Infrastructure Software Arbitrary File Read Vulnerabilities | |
| CVE-2019-1961 | Cisco Enterprise NFV Infrastructure Software Web Portal Arbitrary File Read Vulnerability | |
| CVE-2019-1970 | Cisco Firepower Threat Defense Software File Policy Bypass Vulnerability | |
| CVE-2019-1971 | Cisco Enterprise NFV Infrastructure Software Command Injection Vulnerability | |
| CVE-2019-1972 | Cisco Enterprise NFV Infrastructure Software Privilege Escalation Vulnerability | |
| CVE-2019-1953 | Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability | |
| CVE-2019-1954 | Cisco Webex Meetings Server Open Redirection Vulnerability | |
| CVE-2019-1955 | Cisco Email Security Appliance Header Injection Vulnerability | |
| CVE-2019-1957 | Cisco IoT Field Network Director TLS Renegotiation Denial of Service Vulnerability | |
| CVE-2019-1958 | Cisco HyperFlex Software Cross-Site Request Forgery Vulnerability | |
| CVE-2019-1949 | Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability | |
| CVE-2019-1951 | Cisco SD-WAN Solution Packet Filtering Bypass Vulnerability | |
| CVE-2019-1952 | Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability | |
| CVE-2019-1946 | Cisco Enterprise NFV Infrastructure Software Web-Based Management Interface Authentication |
IV. Related Vulnerabilities
Same product: Cisco SPA112 2-Port Phone Adapter
-
CVE-2019-15258
Cisco SPA100 Series Analog Telephone Adapters Web Management -
CVE-2019-15257
Cisco SPA100 Series Analog Telephone Adapters Running Config -
CVE-2019-15252
Cisco SPA100 Series Analog Telephone Adapters Remote Code Ex -
CVE-2019-15251
Cisco SPA100 Series Analog Telephone Adapters Remote Code Ex -
CVE-2019-15250
Cisco SPA100 Series Analog Telephone Adapters Remote Code Ex
Same vendor: Cisco
-
CVE-2026-20320
Cisco BroadWorks OCI解析器XEE漏洞 -
CVE-2026-20327
Cisco Unified Intelligence Center SQL Injection Vulnerabilit -
CVE-2026-20314
Cisco Packaged Contact Center Enterprise & Cisco Unified Con -
CVE-2026-20319
Cisco Secure Workload Software Security Hardening Release Au -
CVE-2026-20315
Cisco Secure Workload Software Security Hardening Release Au
Same weakness: CWE-79
-
CVE-2026-78282
WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scrip -
CVE-2026-78264
WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scrip -
CVE-2026-78263
WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scri -
CVE-2026-32556
WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) -
CVE-2026-71503
Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administrat
V. Comments for CVE-2019-1956
No comments yet