A vulnerability in the common Session Initiation Protocol (SIP) library of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient sanity checks on an internal data structure. An attacker could exploit this vulnerability by sending a sequence of malicious SIP messages to an affected device. An exploit could allow the attacker to cause a NULL pointer dereference, resulting in a crash of the iosd process. This triggers a reload of the device.
2019-09-25T21:15:10.717
2024-11-21T04:23:16.343
Modified
CVSSv3.1: 7.5 (HIGH)
AV:N/AC:L/Au:N/C:N/I:N/A:C
10.0
6.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Operating System | cisco | ios_xe | 15.6\(1\)s4.2 | Yes |
| Operating System | cisco | ios_xe | 16.3.8 | Yes |
| Operating System | cisco | ios_xe | 16.9.1 | Yes |
| Hardware | cisco | 1000_integrated_services_router | - | No |
| Hardware | cisco | 1100_integrated_services_router | - | No |
| Hardware | cisco | 4000_integrated_services_router | - | No |
| Hardware | cisco | 4221_integrated_services_router | - | No |
| Hardware | cisco | 4321_integrated_services_router | - | No |
| Hardware | cisco | 4331_integrated_services_router | - | No |
| Hardware | cisco | 4351_integrated_services_router | - | No |
| Hardware | cisco | 4431_integrated_services_router | - | No |
| Hardware | cisco | 4451-x_integrated_services_router | - | No |
| Hardware | cisco | asr_1000 | - | No |
| Hardware | cisco | asr_1001-hx | - | No |
| Hardware | cisco | asr_1001-x | - | No |
| Hardware | cisco | asr_1002-hx | - | No |
| Hardware | cisco | asr_1002-x | - | No |
| Hardware | cisco | cloud_services_router_1000v | - | No |
| Hardware | cisco | integrated_services_virtual_router | - | No |