CVE-2026-96774: SPON IP Audio Device Information Disclosure

CVE-2026-96774 Overview

CVE-2026-96774 is an information disclosure vulnerability in the SPON Communications IP Network Audio Device XC-9603, firmware version 1.2.3_20181106 Build 107. The flaw resides in the loadCfg function handling the /ini/sys_cfg.txt configuration file within the Configuration File Download component. Remote attackers can retrieve the configuration file without authentication, exposing sensitive device data. The vendor was contacted prior to disclosure but did not respond, leaving affected devices without an official fix. The weakness is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can download the device configuration file /ini/sys_cfg.txt, potentially exposing credentials and operational settings used to compromise the audio device or pivot into connected networks.

Affected Products

SPON Communications IP Network Audio Device XC-9603
Firmware version 1.2.3_20181106 Build 107
Configuration File Download component (loadCfg function, /ini/sys_cfg.txt)

Discovery Timeline

2026-09-24 - CVE-2026-96774 published to NVD
2026-09-24 - Last updated in NVD database
Vendor contacted prior to publication but did not respond

Technical Details for CVE-2026-96774

Vulnerability Analysis

The vulnerability affects the loadCfg function used by the Configuration File Download component of the XC-9603 IP network audio device. The function serves the /ini/sys_cfg.txt file over the network without enforcing authentication or authorization checks. Attackers can request the configuration file directly and receive its contents.

Configuration files on embedded audio broadcasting devices typically contain network settings, device identifiers, SIP account details, and credentials used to join broadcast servers. Exposure of these values enables credential reuse, impersonation of the device, and reconnaissance of the surrounding network. The EPSS score indicates a low near-term exploitation probability, but public disclosure without a vendor patch raises residual risk.

Root Cause

The root cause is missing access control on the configuration download handler. The loadCfg routine reads /ini/sys_cfg.txt from the device filesystem and returns the content in response to a crafted HTTP request. No session, token, or role check gates the request, which is the pattern described by [CWE-200].

Attack Vector

The attack is remote and network-based. An attacker reachable on the same network as the device, or across the internet if the management interface is exposed, issues a direct HTTP request to the endpoint that invokes loadCfg. The device returns the configuration file content, disclosing stored settings. No user interaction and no prior privileges are required.

No verified public proof-of-concept code was identified at the time of writing. Refer to the VulDB entry for CVE-2026-96774 and VulDB Vulnerability #409033 for additional technical context.

Detection Methods for CVE-2026-96774

Indicators of Compromise

HTTP GET requests from external or unexpected internal hosts targeting /ini/sys_cfg.txt on XC-9603 devices.
Successful 200 OK responses containing configuration content served by the loadCfg handler.
Repeated enumeration patterns scanning multiple XC-9603 IP addresses for the same path.

Detection Strategies

Inspect web server and reverse proxy logs for requests to /ini/sys_cfg.txt and other /ini/*.txt paths.
Deploy network intrusion detection signatures that flag HTTP responses carrying known SPON configuration keys to clients outside the management subnet.
Correlate configuration file retrievals with subsequent SIP registration anomalies or new logins using credentials sourced from the device.

Monitoring Recommendations

Centralize logs from network devices and HTTP front-ends into a SIEM for longitudinal analysis of configuration access.
Alert on any external IP accessing the device management interface, which should be restricted to administrative networks.
Monitor for lateral movement from the device subnet to higher-value assets following unusual configuration downloads.

How to Mitigate CVE-2026-96774

Immediate Actions Required

Remove the XC-9603 management interface from the public internet and restrict it to a dedicated management VLAN.
Rotate any credentials, SIP accounts, or shared secrets stored in /ini/sys_cfg.txt under the assumption of disclosure.
Inventory all SPON XC-9603 devices running firmware 1.2.3_20181106 Build 107 to scope exposure.

Patch Information

No vendor patch has been published. The vendor did not respond to the disclosure attempt reported in the VulDB entry for CVE-2026-96774. Operators should track vendor announcements and apply firmware updates when available.

Workarounds

Place the device behind a firewall or ACL that permits HTTP access only from authorized administrative hosts.
Terminate TLS and enforce authentication at an upstream reverse proxy that blocks direct requests to /ini/sys_cfg.txt.
Segment IP audio devices on an isolated VLAN with no routing to sensitive internal systems or the internet.
Audit configuration contents to remove any high-value or reusable credentials where feasible.

bash

# Example iptables rule limiting HTTP access to the device management interface
# Replace 10.10.0.0/24 with your administrative subnet and eth0 with the device-facing interface
iptables -A INPUT -i eth0 -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP