Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-0325

A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 7800 Series phones and Cisco IP Phone 8800 Series phones could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected phone. The vulnerability is due to incomplete input validation of SIP Session Description Protocol (SDP) parameters by the SDP parser of an affected phone. An attacker could exploit this vulnerability by sending a malformed SIP packet to an affected phone. A successful exploit could allow the attacker to cause all active phone calls on the affected phone to be dropped while the SIP process on the phone unexpectedly restarts, resulting in a DoS condition. Cisco Bug IDs: CSCvf40066.

Published

2018-05-17T03:29:00.810

Last Modified

2024-11-21T03:37:58.917

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-20
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System cisco ip_phone_8800_firmware 9.4\(2\)sr4 Yes
Operating System cisco ip_phone_8800_firmware 10.3\(1\)sr4 Yes
Hardware cisco ip_phone_8800 - No
Operating System cisco ip_phone_7800_firmware < 12.1\(1.12\) Yes
Hardware cisco ip_phone_7800 - No
Operating System cisco ip_phone_7800_firmware < 12.1\(1\)mn130 Yes
Hardware cisco ip_phone_7800 - No
References