20
While setting up a VoIP service in their home, security researchers at Tenable Research discovered a total of 19 vulnerabilities in VoIP adapters from Cisco's SPA100 Series.If exploited, these vulnerabilities could allow an attacker to eavesdrop on a user's conversations, initiate fraudulent phone calls and even pivot further into their internal network.Security researchers Andrew Orr and Alex Weber purchased Cisco's SPA112 and SPA122 Analog Telephone Adapters (ATA) which connect a landline phone to a VoIP network.
However, the two became curious about the security of these devices which have a large attack surface and began to run tests to see if any vulnerabilities were present in their recently purchased hardware.Upon further inspection, they found that leveraging the flaws they found in Cisco's devices would allow a cybercriminal to completely compromise the web interface of the adapters as well as the underlying operating system.According to a blog post published by the security researchers, the flaws they discovered would enable an attacker to steal credentials, create superusers with full privileges and execute arbitrary code.
They also explained how they were able to achieve privilege escalation on Cisco's VoIP adapters, saying:“We were able to take the lower-privilege “cisco” user, leak the “admin” user’s password hash and then “pass-the-hash” to elevate our privileges.
Separately, we were able to use an arbitrary file read to defeat ASLR, and then exploit a stack overflow to achieve code execution as root.”Tenable Research informed Cisco PSIRT of the 19 vulnerabilities they discovered across seven Cisco security advisories and the networking giant has since addressed these flaws with a new 1.4.1 SR5 firmware release for their SPA 100 series devices.By using Shodan, the security researchers were able to identify a total of 3,662 potentially vulnerable devices so if you're using a Cisco SPA 100 series VoIP adapter, it is highly recommended that you update to the latest firmware before these flaws are exploited in the wild.
