7 ms·

Dump these insecure phone adapters because we're not fixing them, says Cisco

42 points by PeterCorless 3y ago

juliangmp 3y ago
This feels like it should be illegal
PeterCorless 3y ago
Also see: Cisco SPA112 2-Port Phone Adapters Remote Command Execution Vulnerability [Listed as "Critical" "No workarounds available"] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-unauth-upgrade-UqhyTWW https://sec.cloudapps.cisco.com/security/center/content/Cisc...
- bombcar 3y ago
  https://www.cisco.com/c/en/us/support/unified-communications/spa112-2-port-phone-adapter/model.html https://www.cisco.com/c/en/us/support/unified-communications... Interesting: Release Date 29-AUG-2011 End-of-Sale Date 01-JUN-2020 End-of-Support Date 31-MAY-2025
- Scoundreller 3y ago
  > This vulnerability is due to a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. > There are no workarounds that address this vulnerability. Just crack the thing open and hard-wire the Write-Enable line to high and you’re good. Here’s a tear down: https://goughlui.com/2016/02/14/review-teardown-cisco-spa112-2-port-analog-telephone-adapter/ https://goughlui.com/2016/02/14/review-teardown-cisco-spa112... And here’s the data sheet to the flash chip: https://www.mxic.com.tw/Lists/Datasheet/Attachments/8448/MX30LF1G08AA,%203V,%201Gb,%20v1.5.pdf https://www.mxic.com.tw/Lists/Datasheet/Attachments/8448/MX3... Pin18 Voilà, enjoy your discount SPA112s! (Or set pin19 write-protect to GND, can probably do that without even cutting a trace. Pin 20 is “NC” and might be wired to GND anyway so blobbing the two together might do it).
  - Scoundreller 3y ago
    I suppose another workaround is to firewall every IP everything except your SIP provider's range and your local subnet. Probably a good idea for all ATAs unless you actually need to web-admin it externally.
whoopdedo 3y ago
Allows unsigned firmware to be uploaded, eh? Sounds like an opportunity to flash the phone with our own open source firmware. Even better if it fixes the remote exploit.
crazygringo 3y ago
> Security hole ranks... 0 out of 10 in patch availability Seems like this is because the product already had its software maintenance "end-of-life" in June 2020 [1]. Though it was also being sold up to that date, which seems bizarre that you could buy a product that would be "end-of-life" the very next day. Also, it continues to receive hardware support for another 5 years (through May 2025). I understand that companies can't provide security updates infinitely for old products, but I have a hard time seeing logic for not providing updates when they're still under a hardware support contract. Seems like something should either be supported or not, not in an insecure in-between state. [1] https://www.cisco.com/c/en/us/products/collateral/unified-communications/small-business-voice-gateways-ata/eos-eol-notice-c51-743206.html https://www.cisco.com/c/en/us/products/collateral/unified-co...
- daniel-cussen 3y ago
  [dead]
- Maxburn 3y ago
  I don't work with Cisco kit but it certainly seems like they are hostile in the support realm. Even if you buy something used and there are software patches available for it you can't get them without a support contract for example. Stories like this "something serious is wrong and Cisco says get rid of it" seem fairly common as well. They must be damn amazing at what they do because these support stories would have me looking elsewhere.
  - psd1 3y ago
    The prevailing opinion on /r/networking is that cisco is trading on reputation and position, like a tank rolling forward with all the crew dead. Competitors matched their features years ago and cisco has been unable to innovate due to crippling technical debt in legacy product lines (build system is: find Nancy and ask her to compile with her version of this feature) and glaring deficiencies with their Firepower successor line. That's my potted sentiment analysis, anyway
    - 3y ago
bitwize 3y ago
Things like this are why "signed, approved boot chain from power on to end user application" for all digital devices is currently in the "yes, it's happening, and here's why it's a good thing" phase.
- numpad0 3y ago
  “Real” Cisco phones like those behind President Zelenskyy on magazine covers take .cop.sgn files, and can deal with SSL-VPN, encrypted media and/or signaling, IPv6, device certificates, etc. those features with a guard on duty usually suffices. It’s available if you need it and are willing to pay for, and freemium version is just coming later. (They’re EOL too and on eBay dirt cheap. I don’t know if my calls are actually encrypted but it can be fun to burn a weekend trying to register it to FreePBX)
  - simfree 3y ago
    Cisco phones are rough even with CUCM as the central server. They freeze randomly when connected to CUCM, to the point that its a pastime to walk into an office and look at the time and date shown onscreen on all the frozen Cisco phones. Note that this freezing issue primarily affects phones made in the last decade from Cisco.
    - bombcar 3y ago
      CUCM was originally developed by Selsius and never really felt like a "Cisco-quality" product.
- misterprime 3y ago
  Back in the earlier days of Android phones, it was fun to burn custom ROMs to try community-developed interfaces. This community was always upset when phone manufacturer's made it more and more difficult to do this. However, I think I'm understanding that this "signed, approved boot chain from power on to end user application" for all digital devices" is necessary for security purposes and would hopefully make it impossible to burn a custom ROM onto a phone.
numpad0 3y ago
Looks like a lineage from Linksys, which is a subsidiary known for once-ubiquitous WRT54G. IP phones from Cisco proper are much different, and I wouldn’t be surprised if they didn’t have build environment for this one ready to go.
- dsr_ 3y ago
  These came from Sipura, which Linksys bought. The last time I had some in service, they were responsible for connecting landlines for FAX and 911 service. (This was before VOIP exchanges had E911 availability and while FAX was still a viable protocol for signed documents.)
SoftTalker 3y ago
My work has completely changed over their telephony technology at least three times in 10 years. My parents had the same bakelite Western Electric phone on the kitchen wall for over three decades. Our defintion of technological advancement seems to be shorter-lived, throwaway stuff that compromises our privacy and demands frequent replacement. And the pace of obsolescence seems to be accelerating.
- kayodelycaon 3y ago
  I think a company needs a solution that’s a bit more involved than an analog phone screwed to a wall.
  - jaredhallen 3y ago
    True. I've used the ATA190 that's recommended as a replacement. Pretty slick little piece of equipment. We had a copper pair supplying dial tone to an analog phone fail, but our fiber was fine. The little box talked to the PBX using SIP and supplied 2 analog ports. Got us through Winter until we could dig up and replace the copper plant.
- Analemma_ 3y ago
  Same here. And what's amazing is that it never fixes anything. I've been in the software industry well over ten years, and been at companies that had multiple meeting room overhauls, and yet meetings regularly still start with the same crap about the AV equipment not working: host not sure if they're presenting, microphone feedback loops, etc. It's like we're running completely in place.
  - bombcar 3y ago
    We need a new word that means "Hello, can you hear me?" and one that means "Hi, yes we can."
    - majesticmerc 3y ago
      Syn/ack :-P
josephcsible 3y ago
> while the last date to extend or renew a service contract for the product isn't until August 2024, Cisco said in the advisory it will not release firmware updates to address the flaw and there are no workarounds. Why does Cisco get to take/keep people's money for service contracts when they don't provide the service?
- neilv 3y ago
  I'd just guess that all of Cisco's customers are organizations that can do one-off negotiations (e.g., complain to sales rep, have lawyer write nastygram), and normally don't want to get involved in addressing the problem for everyone (by, e.g., complaining to government officials, raising a fuss on social media)?

42 points by PeterCorless 3y ago

This feels like it should be illegal

Also see: Cisco SPA112 2-Port Phone Adapters Remote Command Execution Vulnerability [Listed as "Critical" "No workarounds available"] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-unauth-upgrade-UqhyTWW https://sec.cloudapps.cisco.com/security/center/content/Cisc...

bombcar 3y ago
https://www.cisco.com/c/en/us/support/unified-communications/spa112-2-port-phone-adapter/model.html https://www.cisco.com/c/en/us/support/unified-communications... Interesting: Release Date 29-AUG-2011 End-of-Sale Date 01-JUN-2020 End-of-Support Date 31-MAY-2025
Scoundreller 3y ago
> This vulnerability is due to a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. > There are no workarounds that address this vulnerability. Just crack the thing open and hard-wire the Write-Enable line to high and you’re good. Here’s a tear down: https://goughlui.com/2016/02/14/review-teardown-cisco-spa112-2-port-analog-telephone-adapter/ https://goughlui.com/2016/02/14/review-teardown-cisco-spa112... And here’s the data sheet to the flash chip: https://www.mxic.com.tw/Lists/Datasheet/Attachments/8448/MX30LF1G08AA,%203V,%201Gb,%20v1.5.pdf https://www.mxic.com.tw/Lists/Datasheet/Attachments/8448/MX3... Pin18 Voilà, enjoy your discount SPA112s! (Or set pin19 write-protect to GND, can probably do that without even cutting a trace. Pin 20 is “NC” and might be wired to GND anyway so blobbing the two together might do it).
- Scoundreller 3y ago
  I suppose another workaround is to firewall every IP everything except your SIP provider's range and your local subnet. Probably a good idea for all ATAs unless you actually need to web-admin it externally.

whoopdedo 3y ago

Allows unsigned firmware to be uploaded, eh? Sounds like an opportunity to flash the phone with our own open source firmware. Even better if it fixes the remote exploit.

crazygringo 3y ago

> Security hole ranks... 0 out of 10 in patch availability Seems like this is because the product already had its software maintenance "end-of-life" in June 2020 [1]. Though it was also being sold up to that date, which seems bizarre that you could buy a product that would be "end-of-life" the very next day. Also, it continues to receive hardware support for another 5 years (through May 2025). I understand that companies can't provide security updates infinitely for old products, but I have a hard time seeing logic for not providing updates when they're still under a hardware support contract. Seems like something should either be supported or not, not in an insecure in-between state. [1] https://www.cisco.com/c/en/us/products/collateral/unified-communications/small-business-voice-gateways-ata/eos-eol-notice-c51-743206.html https://www.cisco.com/c/en/us/products/collateral/unified-co...

daniel-cussen 3y ago
[dead]
Maxburn 3y ago
I don't work with Cisco kit but it certainly seems like they are hostile in the support realm. Even if you buy something used and there are software patches available for it you can't get them without a support contract for example. Stories like this "something serious is wrong and Cisco says get rid of it" seem fairly common as well. They must be damn amazing at what they do because these support stories would have me looking elsewhere.
- psd1 3y ago
  The prevailing opinion on /r/networking is that cisco is trading on reputation and position, like a tank rolling forward with all the crew dead. Competitors matched their features years ago and cisco has been unable to innovate due to crippling technical debt in legacy product lines (build system is: find Nancy and ask her to compile with her version of this feature) and glaring deficiencies with their Firepower successor line. That's my potted sentiment analysis, anyway
  - 3y ago

bitwize 3y ago

Things like this are why "signed, approved boot chain from power on to end user application" for all digital devices is currently in the "yes, it's happening, and here's why it's a good thing" phase.

numpad0 3y ago
“Real” Cisco phones like those behind President Zelenskyy on magazine covers take .cop.sgn files, and can deal with SSL-VPN, encrypted media and/or signaling, IPv6, device certificates, etc. those features with a guard on duty usually suffices. It’s available if you need it and are willing to pay for, and freemium version is just coming later. (They’re EOL too and on eBay dirt cheap. I don’t know if my calls are actually encrypted but it can be fun to burn a weekend trying to register it to FreePBX)
- simfree 3y ago
  Cisco phones are rough even with CUCM as the central server. They freeze randomly when connected to CUCM, to the point that its a pastime to walk into an office and look at the time and date shown onscreen on all the frozen Cisco phones. Note that this freezing issue primarily affects phones made in the last decade from Cisco.
  - bombcar 3y ago
    CUCM was originally developed by Selsius and never really felt like a "Cisco-quality" product.
misterprime 3y ago
Back in the earlier days of Android phones, it was fun to burn custom ROMs to try community-developed interfaces. This community was always upset when phone manufacturer's made it more and more difficult to do this. However, I think I'm understanding that this "signed, approved boot chain from power on to end user application" for all digital devices" is necessary for security purposes and would hopefully make it impossible to burn a custom ROM onto a phone.

numpad0 3y ago

Looks like a lineage from Linksys, which is a subsidiary known for once-ubiquitous WRT54G. IP phones from Cisco proper are much different, and I wouldn’t be surprised if they didn’t have build environment for this one ready to go.

dsr_ 3y ago
These came from Sipura, which Linksys bought. The last time I had some in service, they were responsible for connecting landlines for FAX and 911 service. (This was before VOIP exchanges had E911 availability and while FAX was still a viable protocol for signed documents.)

SoftTalker 3y ago

My work has completely changed over their telephony technology at least three times in 10 years. My parents had the same bakelite Western Electric phone on the kitchen wall for over three decades. Our defintion of technological advancement seems to be shorter-lived, throwaway stuff that compromises our privacy and demands frequent replacement. And the pace of obsolescence seems to be accelerating.

kayodelycaon 3y ago
I think a company needs a solution that’s a bit more involved than an analog phone screwed to a wall.
- jaredhallen 3y ago
  True. I've used the ATA190 that's recommended as a replacement. Pretty slick little piece of equipment. We had a copper pair supplying dial tone to an analog phone fail, but our fiber was fine. The little box talked to the PBX using SIP and supplied 2 analog ports. Got us through Winter until we could dig up and replace the copper plant.
Analemma_ 3y ago
Same here. And what's amazing is that it never fixes anything. I've been in the software industry well over ten years, and been at companies that had multiple meeting room overhauls, and yet meetings regularly still start with the same crap about the AV equipment not working: host not sure if they're presenting, microphone feedback loops, etc. It's like we're running completely in place.
- bombcar 3y ago
  We need a new word that means "Hello, can you hear me?" and one that means "Hi, yes we can."
  - majesticmerc 3y ago
    Syn/ack :-P

josephcsible 3y ago

> while the last date to extend or renew a service contract for the product isn't until August 2024, Cisco said in the advisory it will not release firmware updates to address the flaw and there are no workarounds. Why does Cisco get to take/keep people's money for service contracts when they don't provide the service?

neilv 3y ago
I'd just guess that all of Cisco's customers are organizations that can do one-off negotiations (e.g., complain to sales rep, have lawyer write nastygram), and normally don't want to get involved in addressing the problem for everyone (by, e.g., complaining to government officials, raising a fuss on social media)?