CVE-2019-12654CWE-476

Cisco IOS and IOS XE Software Session Initiation Protocol Denial of Service Vulnerability

High · published September 25, 2019

CVSS v3.0
8.6
EPSS
2%
Percentile
80.4
In the wild
Unconfirmed
What it is

A vulnerability in the common Session Initiation Protocol (SIP) library of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient sanity checks on an internal data structure. An attacker could exploit this vulnerability by sending a sequence of malicious SIP messages to an affected device. An exploit could allow the attacker to cause a NULL pointer dereference, resulting in a crash of the iosd process. This triggers a reload of the device.

The record
Technical detail
CVSS v3.0
8.6 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01984 · 80.4th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2019-09-25T20:16Z
EPSS history
Timeline
  • 25 SEP 20:16Z
    Cisco IOS and IOS XE Software Session Initiation Protocol Denial of Service Vulnerability
    cvelistv5