{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2019-1683",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2019-1683",
    "idYear": 2019,
    "status": "PUBLISHED",
    "publishedAt": "2019-02-25T17:00:00.000Z",
    "updatedAt": "2024-11-21T19:44:31.986Z",
    "importedAt": "2026-10-24T01:56:08.750Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Cisco SPA112, SPA525, and SPA5x5 Series IP Phones Certificate Validation Vulnerability",
      "summary": "A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security (TLS)-encrypted Session Initiation Protocol (SIP) conversation. The vulnerability is due to the improper validation of server certificates. An attacker could exploit this vulnerability by crafting a malicious server certificate to present to the client. An exploit could allow an attacker to eavesdrop on TLS-encrypted traffic and potentially route or redirect calls initiated by an affected device. Affected software include version 7.6.2 of the Cisco Small Business SPA525 Series IP Phones and Cisco Small Business SPA5X5 Series IP Phones and version 1.4.2 of the Cisco Small Business SPA500 Series IP Phones and Cisco Small Business SPA112 Series IP Phones.",
      "affected": [
        {
          "vendor": "Cisco",
          "product": "Cisco Small Business SPA500 Series IP Phones",
          "versions": [
            {
              "version": "1.4.2",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Cisco",
          "product": "Cisco Small Business SPA112 Series IP Phones",
          "versions": [
            {
              "version": "1.4.2",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Cisco",
          "product": "Cisco Small Business SPA525 Series IP Phones",
          "versions": [
            {
              "version": "7.6.2",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Cisco",
          "product": "Cisco Small Business SPA5X5 Series IP Phones",
          "versions": [
            {
              "version": "7.6.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}