CVE-2026-96774
Received Received - Intake

Information Disclosure in SPON Communications IP Network Audio Device

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulDB

Description
A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. This affects the function loadCfg of the file /ini/sys_cfg.txt of the component Configuration File Download. The manipulation results in information disclosure. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-96774
EUVD
EUVD-2026-85761

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
spon_communications ip_network_audio_device 1.2.3_20181106

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the SPON Communications IP Network Audio Device XC-9603 version 1.2.3_20181106 Build 107. It involves a flaw in the loadCfg function of the file /ini/sys_cfg.txt, specifically in the component for configuration file download. The issue allows remote attackers to disclose sensitive information due to improper handling of configuration data.

Detection Guidance

This vulnerability involves an information disclosure issue in SPON Communications IP Network Audio Device XC-9603. Detection may involve checking for unauthorized access to the /ini/sys_cfg.txt file via network requests or examining device logs for unusual configuration file downloads. No specific commands are provided in the context.

Impact Analysis

An attacker could remotely access the device and extract sensitive configuration details, potentially including network settings, credentials, or other confidential data stored in the configuration file. This could lead to further attacks on the network or compromise of connected systems.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, violating privacy requirements under GDPR and HIPAA. Organizations using this device may fail compliance audits if the vulnerability is not addressed, as it exposes protected information to potential breaches.

Mitigation Strategies

Isolate affected SPON Communications IP Network Audio Devices from critical network segments. Disable remote configuration file download functionality if not required. Monitor network traffic for unauthorized access attempts to /ini/sys_cfg.txt. Update to a patched firmware version if available from the vendor.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96774. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart