3 ms·

Also see: Cisco SPA112 2-Port Phone Adapters Remote Command Execution Vulnerability [Listed as "Critical" "No workarounds available"] https://sec.cloudapps.cis

Also see: Cisco SPA112 2-Port Phone Adapters Remote Command Execution Vulnerability [Listed as "Critical" "No workarounds available"] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-unauth-upgrade-UqhyTWW https://sec.cloudapps.cisco.com/security/center/content/Cisc...

bombcar 3y ago
https://www.cisco.com/c/en/us/support/unified-communications/spa112-2-port-phone-adapter/model.html https://www.cisco.com/c/en/us/support/unified-communications... Interesting: Release Date 29-AUG-2011 End-of-Sale Date 01-JUN-2020 End-of-Support Date 31-MAY-2025
Scoundreller 3y ago
> This vulnerability is due to a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. > There are no workarounds that address this vulnerability. Just crack the thing open and hard-wire the Write-Enable line to high and you’re good. Here’s a tear down: https://goughlui.com/2016/02/14/review-teardown-cisco-spa112-2-port-analog-telephone-adapter/ https://goughlui.com/2016/02/14/review-teardown-cisco-spa112... And here’s the data sheet to the flash chip: https://www.mxic.com.tw/Lists/Datasheet/Attachments/8448/MX30LF1G08AA,%203V,%201Gb,%20v1.5.pdf https://www.mxic.com.tw/Lists/Datasheet/Attachments/8448/MX3... Pin18 Voilà, enjoy your discount SPA112s! (Or set pin19 write-protect to GND, can probably do that without even cutting a trace. Pin 20 is “NC” and might be wired to GND anyway so blobbing the two together might do it).
- Scoundreller 3y ago
  I suppose another workaround is to firewall every IP everything except your SIP provider's range and your local subnet. Probably a good idea for all ATAs unless you actually need to web-admin it externally.

bombcar 3y ago

https://www.cisco.com/c/en/us/support/unified-communications/spa112-2-port-phone-adapter/model.html https://www.cisco.com/c/en/us/support/unified-communications... Interesting: Release Date 29-AUG-2011 End-of-Sale Date 01-JUN-2020 End-of-Support Date 31-MAY-2025

Scoundreller 3y ago

> This vulnerability is due to a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. > There are no workarounds that address this vulnerability. Just crack the thing open and hard-wire the Write-Enable line to high and you’re good. Here’s a tear down: https://goughlui.com/2016/02/14/review-teardown-cisco-spa112-2-port-analog-telephone-adapter/ https://goughlui.com/2016/02/14/review-teardown-cisco-spa112... And here’s the data sheet to the flash chip: https://www.mxic.com.tw/Lists/Datasheet/Attachments/8448/MX30LF1G08AA,%203V,%201Gb,%20v1.5.pdf https://www.mxic.com.tw/Lists/Datasheet/Attachments/8448/MX3... Pin18 Voilà, enjoy your discount SPA112s! (Or set pin19 write-protect to GND, can probably do that without even cutting a trace. Pin 20 is “NC” and might be wired to GND anyway so blobbing the two together might do it).

Scoundreller 3y ago
I suppose another workaround is to firewall every IP everything except your SIP provider's range and your local subnet. Probably a good idea for all ATAs unless you actually need to web-admin it externally.