PT-2018-8760 · Cisco · Cisco Unified Ip Phone

Published 2018-06-07 · Updated 2019-10-09 · CVE-2018-0332

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified IP Phone software (affected versions not specified)

Description A vulnerability in the Session Initiation Protocol (SIP) ingress packet processing could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to a lack of flow-control mechanisms in the software. An attacker could exploit this by sending high volumes of SIP INVITE traffic to the targeted device, potentially disrupting services on the targeted IP phone.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2018-0332

Affected Products

Cisco Unified Ip Phone

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0332 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-ip-phone-dos · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0332 · Vendor Advisory
• http://securitytracker.com/id/1041074 · Note
• http://securityfocus.com/bid/104445 · Note