Cisco SPA100 Series Analog Telephone Adapters Reflected Cross-Site Scripting Vulnerability

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) running firmware releases 1.4.1 SR3 and earlier [1]. The bug is due to insufficient validation of user-supplied input by the web-based management interface, allowing injection of arbitrary script code [1].

Exploitation

An attacker must be an authenticated, remote user with valid credentials for the web interface. The attacker crafts a malicious link containing the XSS payload and persuades a victim user to click it [1]. No additional privileges or specific network position beyond network access to the device are required.

Impact

Successful exploitation allows the attacker to execute arbitrary script code in the context of the victim's browser session on the affected interface, and potentially access sensitive, browser-based information such as session tokens or cookies [1]. The scope is limited to the browser session and the administrative interface of the ATA.

Mitigation

Cisco has not released a firmware fix at the time of publication. There are no workarounds available [1]. Administrators should monitor the Cisco Security Advisories page for updates and restrict access to the web-based management interface to trusted users only [1].