TI-2019-01543 Aliases CVE-2019-1923 GHSA-pcwq-7vcg-g735

Cisco Small Business SPA500 Series IP Phones Local Command Execution Vulnerability

LOW 32CWE-77Published 2019-07-17 · Updated 2024-11-20

Key facts

Attack vector: Physical
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by accessing the configuration interface, which may require a password, and then accessing the device's physical interface and inserting a USB storage device. A successful exploit could allow the attacker to execute arbitrary commands on the device in an elevated security context. At the time of publication, this vulnerability affected Cisco Small Business SPA500 Series IP Phones firmware releases 7.6.2SR5 and prior.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00476 41st percentileScored 2026-11-07

Fix Fixed Cisco SPA525G2 5-line IP Phone (Cisco): 7.6.2SR5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco SPA525G2 5-line IP Phone	before 7.6.2SR5	7.6.2SR5	Patch available	CNA

Cisco SPA525G2 5-line IP Phone VendorCisco Affected before 7.6.2SR5 Fixed in 7.6.2SR5 Patch available CNA

CPE configurations NVD · 20

CPE	Versions	Role	Vendor
cpe:2.3:o:cisco:spa501g_firmware::::::::	up to 7.6.2sr5	Vulnerable	Cisco
cpe:2.3:h:cisco:spa501g:-:::::::*	not specified by NVD	Running on	Cisco
cpe:2.3:o:cisco:spa502g_firmware::::::::	up to 7.6.2sr5	Vulnerable	Cisco
cpe:2.3:h:cisco:spa502g:-:::::::*	not specified by NVD	Running on	Cisco
cpe:2.3:o:cisco:spa504g_firmware::::::::	up to 7.6.2sr5	Vulnerable	Cisco
cpe:2.3:h:cisco:spa504g:-:::::::*	not specified by NVD	Running on	Cisco
cpe:2.3:o:cisco:spa508g_firmware::::::::	up to 7.6.2sr5	Vulnerable	Cisco
cpe:2.3:h:cisco:spa508g:-:::::::*	not specified by NVD	Running on	Cisco
cpe:2.3:o:cisco:spa509g_firmware::::::::	up to 7.6.2sr5	Vulnerable	Cisco
cpe:2.3:h:cisco:spa509g:-:::::::*	not specified by NVD	Running on	Cisco

cpe:2.3:o:cisco:spa501g_firmware:*:*:*:*:*:*:*:* Versions up to 7.6.2sr5 Vulnerable ·Cisco
cpe:2.3:h:cisco:spa501g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
cpe:2.3:o:cisco:spa502g_firmware:*:*:*:*:*:*:*:* Versions up to 7.6.2sr5 Vulnerable ·Cisco
cpe:2.3:h:cisco:spa502g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
cpe:2.3:o:cisco:spa504g_firmware:*:*:*:*:*:*:*:* Versions up to 7.6.2sr5 Vulnerable ·Cisco
cpe:2.3:h:cisco:spa504g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
cpe:2.3:o:cisco:spa508g_firmware:*:*:*:*:*:*:*:* Versions up to 7.6.2sr5 Vulnerable ·Cisco
cpe:2.3:h:cisco:spa508g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
cpe:2.3:o:cisco:spa509g_firmware:*:*:*:*:*:*:*:* Versions up to 7.6.2sr5 Vulnerable ·Cisco
cpe:2.3:h:cisco:spa509g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Show 10 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:cisco:spa512g_firmware::::::::	up to 7.6.2sr5	Vulnerable	Cisco
cpe:2.3:h:cisco:spa512g:-:::::::*	not specified by NVD	Running on	Cisco
cpe:2.3:o:cisco:spa514g_firmware::::::::	up to 7.6.2sr5	Vulnerable	Cisco
cpe:2.3:h:cisco:spa514g:-:::::::*	not specified by NVD	Running on	Cisco
cpe:2.3:o:cisco:spa525g2_firmware::::::::	up to 7.6.2sr5	Vulnerable	Cisco
cpe:2.3:h:cisco:spa525g2:-:::::::*	not specified by NVD	Running on	Cisco
cpe:2.3:o:cisco:spa500s_firmware::::::::	up to 7.6.2sr5	Vulnerable	Cisco
cpe:2.3:h:cisco:spa500s:-:::::::*	not specified by NVD	Running on	Cisco
cpe:2.3:o:cisco:spa500ds_firmware::::::::	up to 7.6.2sr5	Vulnerable	Cisco
cpe:2.3:h:cisco:spa500ds:-:::::::*	not specified by NVD	Running on	Cisco

cpe:2.3:o:cisco:spa512g_firmware:*:*:*:*:*:*:*:* Versions up to 7.6.2sr5 Vulnerable ·Cisco
cpe:2.3:h:cisco:spa512g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
cpe:2.3:o:cisco:spa514g_firmware:*:*:*:*:*:*:*:* Versions up to 7.6.2sr5 Vulnerable ·Cisco
cpe:2.3:h:cisco:spa514g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
cpe:2.3:o:cisco:spa525g2_firmware:*:*:*:*:*:*:*:* Versions up to 7.6.2sr5 Vulnerable ·Cisco
cpe:2.3:h:cisco:spa525g2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
cpe:2.3:o:cisco:spa500s_firmware:*:*:*:*:*:*:*:* Versions up to 7.6.2sr5 Vulnerable ·Cisco
cpe:2.3:h:cisco:spa500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
cpe:2.3:o:cisco:spa500ds_firmware:*:*:*:*:*:*:*:* Versions up to 7.6.2sr5 Vulnerable ·Cisco
cpe:2.3:h:cisco:spa500ds:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

Fix · CNA Cisco SPA525G2 5-line IP Phone (Cisco) Fixed in 7.6.2SR5

Timeline

2026-10-02 Threatist record created from CVE-2019-1923
2026-10-03 Alias added: GHSA-pcwq-7vcg-g735

References

Advisory 1

20190717 Cisco Small Business SPA500 Series IP Phones Local Command Execution Vulnerability

TI-2019-01309 Cisco SPA112, SPA525, and SPA5x5 Series IP Phones Certificate Validation Vulnerability CVSS 3.1HIGH 7.4
TI-2023-06924 Cross-site scripting in Cisco Small Business IP Phones CVSS 3.1MEDIUM 6.1
TI-2023-06887 Cross-site scripting in Cisco Small Business IP Phones CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences