CVE-2023-20218

Vulnerability

The web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) is vulnerable to HTML injection due to insufficient validation of user-supplied input. An authenticated, remote attacker can inject arbitrary HTML or script content. Affected are all software releases running on these devices [1].

Exploitation

An attacker must authenticate to the device (e.g., as an administrator) and then persuade a user (e.g., another administrator) to click a crafted link. The attacker crafts a malicious request to the web interface that includes crafted HTML content. When the victim clicks the link, the injected HTML is rendered in the context of the victim's browser session with the web interface [1].

Impact

Successful exploitation allows the attacker to alter the contents of a web page in the victim's browser, potentially redirecting the user to malicious websites or conducting further client-side attacks (e.g., session hijacking, phishing). The attack is limited to the session of the victim user [1].

Mitigation

Cisco has announced that it will not release software updates to address this vulnerability [1]. No workarounds are available. Users should consider replacing the affected devices or restrict access to the management interface to trusted users only [1].