PT-2017-12436 · Cisco · Cisco Small Business Spa51X+2

Published 2017-10-19 · Updated 2019-10-09 · CVE-2017-12260

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones versions 7.6.2SR1 and earlier

Description A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The issue is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this by using formatted specifiers in a SIP payload sent to an affected device, causing it to become unresponsive until manually restarted.

Recommendations For Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones versions 7.6.2SR1 and earlier, update to a firmware release later than 7.6.2SR1 to resolve the issue. As a temporary workaround, consider restricting access to the SIP functionality to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-12260

Affected Products

Cisco Small Business Spa50X

Cisco Small Business Spa51X

Cisco Small Business Spa52X

References · 5

• https://osv.dev/vulnerability/CVE-2017-12260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12260 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1 · Vendor Advisory
• http://securityfocus.com/bid/101495 · Note
• http://securitytracker.com/id/1039616 · Note