CVE-2019-12646

EPSS 1.97%
Veröffentlicht 25.09.2019 20:15:10
Zuletzt bearbeitet 21.11.2024 04:23:15
Erkennungen
Login

Cisco IOS XE Software NAT Session Initiation Protocol Application Layer Gateway Denial of Service Vulnerability

A vulnerability in the Network Address Translation (NAT) Session Initiation Protocol (SIP) Application Layer Gateway (ALG) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper processing of transient SIP packets on which NAT is performed on an affected device. An attacker could exploit this vulnerability by using UDP port 5060 to send crafted SIP packets through an affected device that is performing NAT for SIP packets. A successful exploit could allow an attacker to cause the device to reload, resulting in a denial of service (DoS) condition.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 4

NVD 13 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Cisco ≫ Ios Xe Version 15.4(3)s

   Cisco ≫ 1100-4p Version -
   Cisco ≫ 1100-8p Version -
   Cisco ≫ 1101-4p Version -
   Cisco ≫ 1109-2p Version -
   Cisco ≫ 1109-4p Version -
   Cisco ≫ 1111x-8p Version -
   Cisco ≫ 4221 Integrated Services Router Version -
   Cisco ≫ 4331 Integrated Services Router Version -
   Cisco ≫ Csr 1000v Version -
   Cisco ≫ Encs 5100 Version -
   Cisco ≫ Encs 5400 Version -
   Cisco ≫ Isrv Version -

Cisco ≫ Ios Xe Version 15.5(3)s

Cisco ≫ Ios Xe Version 15.6(1)s

Cisco ≫ Ios Xe Version 16.3.1

Cisco ≫ Ios Xe Version 16.4.1

Cisco ≫ Ios Xe Version 16.5.1

Cisco ≫ Ios Xe Version 16.6.1

Cisco ≫ Ios Xe Version 16.7.1

Cisco ≫ Ios Xe Version 16.8.1

Cisco ≫ Ios Xe Version 16.9.1

Cisco ≫ Ios Xe Version 16.10.1

Cisco ≫ Ios Xe Version 16.11.1

Cisco ≫ Ios Xe Version 16.12.1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.97%	0.778

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST	7.8	10	6.9	AV:N/AC:L/Au:N/C:N/I:N/A:C
Cisco PSIRT	8.6	3.9	4	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE-665 Improper Initialization

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-sip-alg

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-12646

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-12646

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-12646

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2019-12646