PT-2018-8755 · Cisco · Cisco Ip Phone 8800 Series+1

Published 2018-05-17 · Updated 2019-10-09 · CVE-2018-0325

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IP Phone 7800 Series phones (affected versions not specified) Cisco IP Phone 8800 Series phones (affected versions not specified)

Description A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected phone. The issue is due to incomplete input validation of SIP Session Description Protocol (SDP) parameters by the SDP parser. An attacker could exploit this by sending a malformed SIP packet, causing all active phone calls on the affected phone to be dropped while the SIP process on the phone unexpectedly restarts.

Recommendations For Cisco IP Phone 7800 Series phones, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco IP Phone 8800 Series phones, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-0325

Affected Products

Cisco Ip Phone 7800 Series

Cisco Ip Phone 8800 Series

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0325 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0325 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-ip-phone-dos · Vendor Advisory
• http://securitytracker.com/id/1040927 · Note
• http://securityfocus.com/bid/104202 · Note