Denial of service when processing SIP packets in Cisco ASA and Cisco Firepower Threat Defense
| Risk | High |
| Patch available | NO |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2018-15454 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | This vulnerability is being exploited in the wild. |
| Vulnerable software |
/ Cisco Firepower 9300 Security Appliance Hardware solutions / Security hardware applicances Cisco 7600 Series ASA Services Module Hardware solutions / Security hardware applicances Cisco ASA 5500-X Series Hardware solutions / Security hardware applicances Cisco Firepower 4100 Series Next-Generation Firewall Hardware solutions / Firmware Firepower 2100 Series Security Appliance Server applications / IDS/IPS systems, Firewalls and proxy servers 3000 Series Industrial Security Appliance (ISA) Server applications / IDS/IPS systems, Firewalls and proxy servers Cisco Adaptive Security Virtual Appliance (ASAv) Server applications / Virtualization software |
| Vendor |
Cisco Systems, Inc |
Security Bulletin
This security bulletin contains one high risk vulnerability.
1) Input validation error
EUVDB-ID: #VU15667
Risk: High
CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:U/RC:C]
CVE-ID: CVE-2018-15454
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of SIP traffic. A remote attacker can send specially crafted SIP packets to the affected device, cause high CPU load that may lead to denial of service conditions.
Note, this vulnerability is being actively exploited in the wild against a limited number of targets.
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
: All versions
Cisco Firepower 9300 Security Appliance: 1.1.3 - 2.2.1.101
Cisco Firepower 4100 Series Next-Generation Firewall: 1.1.3 - 2.2.1.101
Firepower 2100 Series Security Appliance: All versions
Cisco Adaptive Security Virtual Appliance (ASAv): All versions
Cisco 7600 Series ASA Services Module: All versions
Cisco ASA 5500-X Series: 9.1.6.11 - 9.9.2.230
3000 Series Industrial Security Appliance (ISA): All versions
CPE2.3- cpe:2.3::::*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco_systems:cisco_firepower_9300_security_appliance:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco_systems:cisco_firepower_9300_security_appliance:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:h:cisco_systems:cisco_firepower_9300_security_appliance:1.1.4:*:*:*:*:*:*:*
- cpe:2.3:h:cisco_systems:cisco_firepower_4100_series_next-generation_firewall:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco_systems:cisco_firepower_4100_series_next-generation_firewall:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:h:cisco_systems:cisco_firepower_4100_series_next-generation_firewall:1.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:cisco_systems:firepower_2100_series_security_appliance:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco_systems:cisco_adaptive_security_virtual_appliance_asav:*:*:*:*:*:asa:*:*
- cpe:2.3:h:cisco_systems:cisco_7600_series_asa_services_module:*:*:*:*:*:asa:*:*
- cpe:2.3:h:cisco_systems:cisco_asa_5500-x_series:*:*:*:*:*:asa:*:*
- cpe:2.3:a:cisco_systems:3000_series_industrial_security_appliance_isa:*:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
