CVE-2019-12646

EPSS 1.03%
Veröffentlicht 25.09.2019 20:15:10
Zuletzt bearbeitet 21.11.2024 04:23:15
Quelle psirt@cisco.com
CVE-Watchlists
Login
Unerledigt
Login

A vulnerability in the Network Address Translation (NAT) Session Initiation Protocol (SIP) Application Layer Gateway (ALG) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper processing of transient SIP packets on which NAT is performed on an affected device. An attacker could exploit this vulnerability by using UDP port 5060 to send crafted SIP packets through an affected device that is performing NAT for SIP packets. A successful exploit could allow an attacker to cause the device to reload, resulting in a denial of service (DoS) condition.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Cisco ≫ Ios Xe Version15.4(3)s

   Cisco ≫ 1100-4p Version-
   Cisco ≫ 1100-8p Version-
   Cisco ≫ 1101-4p Version-
   Cisco ≫ 1109-2p Version-
   Cisco ≫ 1109-4p Version-
   Cisco ≫ 1111x-8p Version-
   Cisco ≫ 4221 Integrated Services Router Version-
   Cisco ≫ 4331 Integrated Services Router Version-
   Cisco ≫ Csr 1000v Version-
   Cisco ≫ Encs 5100 Version-
   Cisco ≫ Encs 5400 Version-
   Cisco ≫ Isrv Version-

Cisco ≫ Ios Xe Version15.5(3)s

Cisco ≫ Ios Xe Version15.6(1)s

Cisco ≫ Ios Xe Version16.3.1

Cisco ≫ Ios Xe Version16.4.1

Cisco ≫ Ios Xe Version16.5.1

Cisco ≫ Ios Xe Version16.6.1

Cisco ≫ Ios Xe Version16.7.1

Cisco ≫ Ios Xe Version16.8.1

Cisco ≫ Ios Xe Version16.9.1

Cisco ≫ Ios Xe Version16.10.1

Cisco ≫ Ios Xe Version16.11.1

Cisco ≫ Ios Xe Version16.12.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.03%	0.766

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov	7.8	10	6.9	AV:N/AC:L/Au:N/C:N/I:N/A:C
psirt@cisco.com	8.6	3.9	4	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE-665 Improper Initialization

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-sip-alg

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-12646

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-12646

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-12646

EUVD