Denial of service in Cisco IP Phones

1) Improper input validation

EUVDB-ID: #VU13227

Risk: Low

CVSSv3.1: 6.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2018-0332

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in the Session Initiation Protocol (SIP) ingress packet processing of Cisco Unified IP Phone software due to a lack of flow-control mechanisms in the software. A remote attacker can send high volumes of SIP INVITE traffic and cause a disruption of services on the targeted IP phone.

Mitigation

No release planned to fix this bug.

Vulnerable software versions

Cisco Unified IP Phone 6900 Series: 9.4.2 SR4

Cisco Unified IP Phone 7900 Series: 9.9.9.99002.1

Cisco Unified IP Phones 9900 Series: 9.9.9.99002.1

Cisco 8800 Series IP Phones: 9.4.2 SR3.1

Cisco 7800 Series IP Phones: 9.4.2 SR3.1

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-ip-phone-dos

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.