{"id":"CVE-2019-15258","aliases":["EUVD-2019-6268","GHSA-rj6q-hm9v-fgrq"],"status":"published","title":"Cisco SPA100 Series Analog Telephone Adapters Web Management Interface Denial of Service Vulnerability","description":"A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper validation of user-supplied requests to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the device to stop responding, requiring manual intervention for recovery.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01399,"percentile":0.72654,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-399","CWE-476"],"published":"2019-10-16T18:36:38Z","modified":"2026-06-17T02:19:57Z","products":[{"vendor":"cisco","product":"cisco spa112 2-port phone adapter"},{"vendor":"cisco","product":"spa112_firmware"},{"vendor":"cisco","product":"spa122_firmware"}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-spa-webui-dos","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Vendor Advisory"]},{"url":"https://www.tenable.com/security/research/tra-2019-44","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15258"},{"url":"https://github.com/advisories/GHSA-rj6q-hm9v-fgrq"}],"sources":{"cve":[{"id":"CVE-2019-15258","title":"Cisco SPA100 Series Analog Telephone Adapters Web Management Interface Denial of Service Vulnerability","description":"A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper validation of user-supplied requests to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the device to stop responding, requiring manual intervention for recovery.","status":"published","published":"2019-10-16T18:36:38.179Z","modified":"2024-11-21T19:08:16.164Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:20:21.397307Z"}],"euvd":[{"id":"EUVD-2019-6268","description":"A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper validation of user-supplied requests to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the device to stop responding, requiring manual intervention for recovery.","status":"published","published":"2019-10-16T18:36:38Z","modified":"2024-11-21T19:08:16Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:04:52.116962Z"}],"ghsa":[{"id":"GHSA-rj6q-hm9v-fgrq","title":"A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone...","description":"A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper validation of user-supplied requests to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the device to stop responding, requiring manual intervention for recovery.","status":"published","published":"2022-05-24T16:58:53Z","modified":"2023-01-28T05:07:35Z","updated_at":"2026-11-02T14:44:32.600172Z"}],"nvd":[{"id":"CVE-2019-15258","description":"A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper validation of user-supplied requests to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the device to stop responding, requiring manual intervention for recovery.","status":"published","published":"2019-10-16T19:15:13.63Z","modified":"2026-06-17T02:19:57.647Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-399","CWE-476"],"updated_at":"2026-11-02T14:05:31.860711Z"}]}}