A medium-severity vulnerability (CVE-2026-96774) was identified in SPON Communications IP Network Audio Device XC-9603 version 1.2.3_20181106 Build 107. The flaw exists in the loadCfg function of the Configuration File Download component, specifically in the /ini/sys_cfg.txt file. This vulnerability allows remote attackers to cause information disclosure without requiring authentication. The vendor was notified but has not responded or provided a fix. No patch or remediation guidance is currently available.