EUVD-2026-85761
GHSA-p47w-5p6m-95vc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web service over network
-
ExploitRequest /ini/sys_cfg.txt (loadCfg)
-
ExecutionReceive unauthenticated config file
-
ImpactHarvest disclosed settings/credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the XC-9603 device's HTTP/configuration service where the Configuration File Download endpoint (loadCfg serving /ini/sys_cfg.txt) is exposed; per CVSS PR:N/UI:N no authentication or user interaction is needed against a reachable device. Limiting factors: the device must be network-reachable (these IP audio/PA endpoints are typically deployed on internal or campus networks rather than the public internet), and the real impact depends on whether the served config file actually contains sensitive data such as credentials. No patch is available since the vendor did not respond. |
| Impact | This is a genuine but low-to-moderate priority issue. The VulDB-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) describes remote, unauthenticated, low-complexity information disclosure with only limited confidentiality impact and no integrity or availability impact - consistent with retrieving a single configuration file. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code referenced (the only references are VulDB catalog/CTI/submit pages), so exploitation is not confirmed and there is no signal of widespread or automated attack activity. The headline 6.9 score is driven by the fully-remote unauthenticated vector rather than by high impact; the practical severity hinges on what /ini/sys_cfg.txt actually contains - if it exposes plaintext administrative or network credentials, real-world impact would be materially higher than the vendor's VC:L rating suggests (this cannot be confirmed from the description and should be verified against the device). Net: a real, easily-triggered flaw but on a niche embedded product with no evidence of active exploitation, so it ranks below internet-facing enterprise CVEs of similar score. |
| Exploit ScenarioDerived | An attacker with network reachability to the XC-9603 device's web interface issues a direct HTTP request for /ini/sys_cfg.txt (handled by the loadCfg function), which returns the system configuration file without authentication. The disclosed configuration may reveal device settings and potentially embedded credentials or network topology, aiding further compromise. No public proof-of-concept or exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Unauthenticated information disclosure in the SPON Communications IP Network Audio Device XC-9603 (firmware 1.2.3_20181106 Build 107) allows remote attackers to retrieve sensitive configuration data, including the contents of /ini/sys_cfg.txt, because the loadCfg configuration-download function does not enforce authorization. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires only network reachability to the device's HTTP/configuration service; no credentials or user interaction are needed, and the real-world impact depends on whether the served configuration file contains credentials or other secrets. There is no vendor-released patch: the vendor was contacted about the disclosure and did not respond, and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuine but low-to-moderate priority issue that is most relevant to organizations exposing these audio/PA endpoints on internal or campus networks.
RemediationAI
No vendor-released patch was identified at time of analysis; SPON Communications was contacted about the disclosure and did not respond, so upgrading is not currently an option and organizations must rely on compensating controls. The most effective step is to stop exposing the device's HTTP configuration service to untrusted networks: place XC-9603 units on a dedicated management VLAN, firewall off TCP access to the web interface (including the /ini/ path prefix that serves sys_cfg.txt) so only authorized admin hosts can reach it, and never publish these audio endpoints to the internet. Note the trade-off - strict filtering breaks remote management and firmware updates, so whitelist the specific admin workstations or jump hosts rather than disabling the interface entirely. If the web UI must stay reachable, front it with a reverse proxy or load balancer that enforces authentication and blocks direct requests to /ini/sys_cfg.txt and similar static config paths; this adds an authentication dependency and may interfere with any legacy tooling that assumes direct device access. As a detective measure, monitor HTTP logs and network flows for direct GETs of /ini/sys_cfg.txt, and treat any retrieved configuration as compromised - rotate device credentials, SIP/registration secrets, and SNMP communities that were stored in the exposed file. Because the file may contain reusable credentials, assume lateral-movement risk even though the vulnerability itself only discloses information. Track the VulDB entries at https://vuldb.com/vuln/409033 and https://vuldb.com/cve/CVE-2026-96774 for any late vendor response or updated fixed-version information.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) within the embedded web management layer of the XC-9603 IP network audio appliance. The affected component is the Configuration File Download handler, whose loadCfg function serves the configuration artifact located at /ini/sys_cfg.txt over the device's HTTP interface - the kind of endpoint normally intended for authenticated administrative backup/export of device settings. Because the request path is reachable without authentication (PR:N) and without user interaction (UI:N) in the assessed CVSS:3.1 vector, any host that can route to the device's web service can pull the file directly. The CPE record cpe:2.3:a:spon_communications:ip_network_audio_device_xc-9603:*:*:*:*:*:*:*:* marks the whole product line as affected rather than a bounded version range, with 1.2.3_20181106 Build 107 the confirmed tested build; the specifics of what sys_cfg.txt contains (network settings, SIP/PBX credentials, SNMP communities, admin hashes, etc.) determine the true severity, which the assessment caps at low confidentiality impact (VC:L) with no integrity or availability effect. This class of embedded-device configuration exposure is common in VoIP/PA hardware, where file-based config backup endpoints are bolted onto lightweight web servers that lack robust access control.
Know when Ip Network Audio Device Xc 9603 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated retrieval of a config file with no interaction gives AV:N/AC:L/PR:N/UI:N; C:L for limited disclosure (C:H if the file exposes credentials), no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. This affects the function loadCfg of the file /ini/sys_cfg.txt of the component Configuration File Download. The manipulation results in information disclosure. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB