Input validation error in Cisco Systems, Inc products - CVE-2018-15454
Published: November 1, 2018
Vulnerability identifier: #VU15667
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-15454
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of SIP traffic. A remote attacker can send specially crafted SIP packets to the affected device, cause high CPU load that may lead to denial of service conditions.
Note, this vulnerability is being actively exploited in the wild against a limited number of targets.
Affected software
3000 Series Industrial Security Appliance (ISA)
Firepower 2100 Series Security Appliance
Cisco ASA 5500-X Series
Cisco 7600 Series ASA Services Module
Cisco Firepower 9300 Security Appliance
Cisco Adaptive Security Virtual Appliance (ASAv)
Cisco Firepower 4100 Series Next-Generation Firewall
How to mitigate CVE-2018-15454
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.