Ip Network Audio Device Xc 9603
Monthly
Unauthenticated information disclosure in the SPON Communications IP Network Audio Device XC-9603 (firmware 1.2.3_20181106 Build 107) allows remote attackers to retrieve sensitive configuration data, including the contents of /ini/sys_cfg.txt, because the loadCfg configuration-download function does not enforce authorization. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires only network reachability to the device's HTTP/configuration service; no credentials or user interaction are needed, and the real-world impact depends on whether the served configuration file contains credentials or other secrets. There is no vendor-released patch: the vendor was contacted about the disclosure and did not respond, and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuine but low-to-moderate priority issue that is most relevant to organizations exposing these audio/PA endpoints on internal or campus networks.
Unauthenticated information disclosure in the SPON Communications IP Network Audio Device XC-9603 (firmware 1.2.3_20181106 Build 107) allows remote attackers to retrieve sensitive configuration data, including the contents of /ini/sys_cfg.txt, because the loadCfg configuration-download function does not enforce authorization. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires only network reachability to the device's HTTP/configuration service; no credentials or user interaction are needed, and the real-world impact depends on whether the served configuration file contains credentials or other secrets. There is no vendor-released patch: the vendor was contacted about the disclosure and did not respond, and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuine but low-to-moderate priority issue that is most relevant to organizations exposing these audio/PA endpoints on internal or campus networks.