Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-12260

A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this vulnerability by using formatted specifiers in a SIP payload that is sent to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. This vulnerability affects Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones that are running firmware release 7.6.2SR1 or earlier. Cisco Bug IDs: CSCvc63986.

Published

2017-10-19T08:29:00.310

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-119
  • Type: Primary
    CWE-119
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System cisco spa_501g_firmware ≤ 7.6.2 Yes
Hardware cisco spa_501g - No
Operating System cisco spa_502g_firmware ≤ 7.6.2 Yes
Hardware cisco spa_502g - No
Operating System cisco spa_504g_firmware ≤ 7.6.2 Yes
Hardware cisco spa_504g - No
Operating System cisco spa_508g_firmware ≤ 7.6.2 Yes
Hardware cisco spa_508g - No
Operating System cisco spa_509g_firmware ≤ 7.6.2 Yes
Hardware cisco spa_509g - No
Operating System cisco spa_512g_firmware ≤ 7.6.2 Yes
Hardware cisco spa_512g - No
Operating System cisco spa_514g_firmware ≤ 7.6.2 Yes
Hardware cisco spa_514g - No
Operating System cisco spa_525g_firmware ≤ 7.6.2 Yes
Hardware cisco spa_525g - No
References