PT-2017-12434 · Cisco · Cisco Small Business Spa51X Series Ip Phones

Published 2017-10-19 · Updated 2019-10-09 · CVE-2017-12259

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Small Business SPA51x Series IP Phones versions 7.6.2SR1 and earlier

Description A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The issue is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this by sending malformed SIP messages to an affected device, causing it to become unresponsive until manually restarted.

Recommendations For Cisco Small Business SPA51x Series IP Phones versions 7.6.2SR1 and earlier, update to a version later than 7.6.2SR1 to resolve the issue. As a temporary workaround, consider restricting access to the SIP functionality to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-12259

Affected Products

Cisco Small Business Spa51X Series Ip Phones

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-12259 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12259 · Vendor Advisory
• http://securitytracker.com/id/1039615 · Note
• http://securityfocus.com/bid/101488 · Note