Lucene search

CiscoCVE-2017-12260

HistoryOct 19, 2017 - 8:29 a.m.

CVE-2017-12260

2017-10-1908:29:00

CWE-119

cisco

web.nvd.nist.gov

cisco

small business

sip

ip phones

vulnerability

denial of service

cisco bug ids

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.6

Confidence

High

EPSS

0.002

Percentile

61.9%

JSON

A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this vulnerability by using formatted specifiers in a SIP payload that is sent to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. This vulnerability affects Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones that are running firmware release 7.6.2SR1 or earlier. Cisco Bug IDs: CSCvc63986.

Affected configurations

Nvd

Node

ciscospa_501g_firmwareRange≤7.6.2sr1

AND

ciscospa_501gMatch-

Node

ciscospa_502g_firmwareRange≤7.6.2sr1

AND

ciscospa_502gMatch-

Node

ciscospa_504g_firmwareRange≤7.6.2sr1

AND

ciscospa_504gMatch-

Node

ciscospa_508g_firmwareRange≤7.6.2sr1

AND

ciscospa_508gMatch-

Node

ciscospa_509g_firmwareRange≤7.6.2sr1

AND

ciscospa_509gMatch-

Node

ciscospa_512g_firmwareRange≤7.6.2sr1

AND

ciscospa_512gMatch-

Node

ciscospa_514g_firmwareRange≤7.6.2sr1

AND

ciscospa_514gMatch-

Node

ciscospa_525g_firmwareRange≤7.6.2sr1

AND

ciscospa_525gMatch-

VendorProductVersionCPE
ciscospa_501g_firmware*cpe:2.3:o:cisco:spa_501g_firmware:*:sr1:*:*:*:*:*:*
ciscospa_501g-cpe:2.3:h:cisco:spa_501g:-:*:*:*:*:*:*:*
ciscospa_502g_firmware*cpe:2.3:o:cisco:spa_502g_firmware:*:sr1:*:*:*:*:*:*
ciscospa_502g-cpe:2.3:h:cisco:spa_502g:-:*:*:*:*:*:*:*
ciscospa_504g_firmware*cpe:2.3:o:cisco:spa_504g_firmware:*:sr1:*:*:*:*:*:*
ciscospa_504g-cpe:2.3:h:cisco:spa_504g:-:*:*:*:*:*:*:*
ciscospa_508g_firmware*cpe:2.3:o:cisco:spa_508g_firmware:*:sr1:*:*:*:*:*:*
ciscospa_508g-cpe:2.3:h:cisco:spa_508g:-:*:*:*:*:*:*:*
ciscospa_509g_firmware*cpe:2.3:o:cisco:spa_509g_firmware:*:sr1:*:*:*:*:*:*
ciscospa_509g-cpe:2.3:h:cisco:spa_509g:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	spa_501g_firmware	*	cpe:2.3:o:cisco:spa_501g_firmware::sr1::::::*
cisco	spa_501g	-	cpe:2.3:h:cisco:spa_501g:-:::::::*
cisco	spa_502g_firmware	*	cpe:2.3:o:cisco:spa_502g_firmware::sr1::::::*
cisco	spa_502g	-	cpe:2.3:h:cisco:spa_502g:-:::::::*
cisco	spa_504g_firmware	*	cpe:2.3:o:cisco:spa_504g_firmware::sr1::::::*
cisco	spa_504g	-	cpe:2.3:h:cisco:spa_504g:-:::::::*
cisco	spa_508g_firmware	*	cpe:2.3:o:cisco:spa_508g_firmware::sr1::::::*
cisco	spa_508g	-	cpe:2.3:h:cisco:spa_508g:-:::::::*
cisco	spa_509g_firmware	*	cpe:2.3:o:cisco:spa_509g_firmware::sr1::::::*
cisco	spa_509g	-	cpe:2.3:h:cisco:spa_509g:-:::::::*

Rows per page:

1-10 of 161

CNA Affected

[
  {
    "product": "Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones"
      }
    ]
  }
]

References

www.securityfocus.com/bid/101495

www.securitytracker.com/id/1039616

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.6

Confidence

High

EPSS

0.002

Percentile

61.9%

JSON

Related for CVE-2017-12260