A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. (CVE-2026-96774)
A medium-severity vulnerability (CVE-2026-96774) was identified in SPON Communications IP Network Audio Device XC-9603 version 1.2.3_20181106 Build 107. The flaw exists in the loadCfg function of the Configuration File Download component, specifically in the /ini/sys_cfg.txt file. This vulnerability allows remote attackers to cause information disclosure without requiring authentication. The vendor was notified but has not responded or provided a fix. No patch or remediation guidance is currently available.
AI Analysis
Technical Summary
CVE-2026-96774 is an information disclosure vulnerability in the SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. The issue is located in the loadCfg function handling the /ini/sys_cfg.txt configuration file download. An attacker can remotely exploit this flaw to disclose sensitive information. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with an attack vector of network, no privileges required, and no user interaction needed. The vendor has not responded to disclosure and no patch or mitigation details are available.
Potential Impact
The vulnerability allows remote attackers to disclose information from the device without authentication or user interaction. This could lead to exposure of sensitive configuration data, potentially aiding further attacks or reconnaissance. There is no indication of impact on integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider restricting network access to the affected device and monitor for unusual activity related to configuration file downloads.
A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. (CVE-2026-96774)
Description
A medium-severity vulnerability (CVE-2026-96774) was identified in SPON Communications IP Network Audio Device XC-9603 version 1.2.3_20181106 Build 107. The flaw exists in the loadCfg function of the Configuration File Download component, specifically in the /ini/sys_cfg.txt file. This vulnerability allows remote attackers to cause information disclosure without requiring authentication. The vendor was notified but has not responded or provided a fix. No patch or remediation guidance is currently available.
CVSS v3.1
Score 5.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-96774 is an information disclosure vulnerability in the SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. The issue is located in the loadCfg function handling the /ini/sys_cfg.txt configuration file download. An attacker can remotely exploit this flaw to disclose sensitive information. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with an attack vector of network, no privileges required, and no user interaction needed. The vendor has not responded to disclosure and no patch or mitigation details are available.
Potential Impact
The vulnerability allows remote attackers to disclose information from the device without authentication or user interaction. This could lead to exposure of sensitive configuration data, potentially aiding further attacks or reconnaissance. There is no indication of impact on integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider restricting network access to the affected device and monitor for unusual activity related to configuration file downloads.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-p47w-5p6m-95vc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-96774"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab4be18f7a7c54106eee65d
Added to database: 09/24/2026, 06:07:20 UTC
Last enriched: 09/24/2026, 06:11:52 UTC
Last updated: 09/24/2026, 18:47:33 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.