7.5

CVE-2017-12260

A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this vulnerability by using formatted specifiers in a SIP payload that is sent to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. This vulnerability affects Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones that are running firmware release 7.6.2SR1 or earlier. Cisco Bug IDs: CSCvc63986.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Spa 501g Firmware Updatesr1 Version <= 7.6.2
   Cisco ≫ Spa 501g Version-
Cisco ≫ Spa 502g Firmware Updatesr1 Version <= 7.6.2
   Cisco ≫ Spa 502g Version-
Cisco ≫ Spa 504g Firmware Updatesr1 Version <= 7.6.2
   Cisco ≫ Spa 504g Version-
Cisco ≫ Spa 508g Firmware Updatesr1 Version <= 7.6.2
   Cisco ≫ Spa 508g Version-
Cisco ≫ Spa 509g Firmware Updatesr1 Version <= 7.6.2
   Cisco ≫ Spa 509g Version-
Cisco ≫ Spa 512g Firmware Updatesr1 Version <= 7.6.2
   Cisco ≫ Spa 512g Version-
Cisco ≫ Spa 514g Firmware Updatesr1 Version <= 7.6.2
   Cisco ≫ Spa 514g Version-
Cisco ≫ Spa 525g Firmware Updatesr1 Version <= 7.6.2
   Cisco ≫ Spa 525g Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.41% 0.787
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://www.securityfocus.com/bid/101495
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039616
Third Party Advisory
VDB Entry