Lucene search

CiscoCVE-2017-12259

HistoryOct 19, 2017 - 8:29 a.m.

CVE-2017-12259

2017-10-1908:29:00

CWE-119

cisco

web.nvd.nist.gov

cisco

small business

spa51x

ip phones

sip

dos

vulnerability

cve-2017-12259

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

61.9%

JSON

A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA51x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this vulnerability by sending malformed SIP messages to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. This vulnerability affects Cisco Small Business SPA51x Series IP Phones that are running Cisco SPA51x Firmware Release 7.6.2SR1 or earlier. Cisco Bug IDs: CSCvc63982.

Affected configurations

Nvd

Node

ciscosmall_business_ip_phone_firmwareRange≤7.6.2sr1

AND

ciscosmall_business_ip_phoneMatchspa510

VendorProductVersionCPE
ciscosmall_business_ip_phone_firmware*cpe:2.3:o:cisco:small_business_ip_phone_firmware:*:sr1:*:*:*:*:*:*
ciscosmall_business_ip_phonespa510cpe:2.3:h:cisco:small_business_ip_phone:spa510:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	small_business_ip_phone_firmware	*	cpe:2.3:o:cisco:small_business_ip_phone_firmware::sr1::::::*
cisco	small_business_ip_phone	spa510	cpe:2.3:h:cisco:small_business_ip_phone:spa510:::::::*

CNA Affected

[
  {
    "product": "Cisco Small Business SPA51x Series IP Phones",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Small Business SPA51x Series IP Phones"
      }
    ]
  }
]

References

www.securityfocus.com/bid/101488

www.securitytracker.com/id/1039615

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

61.9%

JSON

Related for CVE-2017-12259