CVE-2019-1683 – Cisco SPA112, SPA525, and SPA5x5 Series IP Phones Certificate Validation Vulnerability

https://notcve.org/view.php?id=CVE-2019-1683

25 Feb 2019 — A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security (TLS)-encrypted Session Initiation Protocol (SIP) conversation. The vulnerability is due to the improper validation of server certificates. An attacker could exploit this vulnerability by crafting a malicious server certificate to present to the client. An exploit could allow an attack... • http://www.securityfocus.com/bid/107111 • CWE-295: Improper Certificate Validation •