PT-2020-1577 · Cisco · Cisco Mobility Management Entity

Published 2020-01-08 · Updated 2020-01-31 · CVE-2019-16026

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Mobility Management Entity (MME) (affected versions not specified)

Description The issue is related to the implementation of the Stream Control Transmission Protocol (SCTP) and is caused by insufficient input validation of SCTP traffic. This could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an eNodeB connected to an affected device. An attacker could exploit this by leveraging a man-in-the-middle position between the eNodeB and the MME and then sending a crafted SCTP message to the MME, causing the MME to stop sending SCTP messages to the eNodeB.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-00618

CVE-2019-16026

Affected Products

Cisco Mobility Management Entity

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-16026 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-mme-dos · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-16026 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00618 · Security Note
• https://t.me/cvenotify/415 · Telegram Post
• https://securitylab.ru/vulnerability/503883.php · Note