#VU12788 Improper input validation in Cisco 7800 Series IP Phones and Cisco 6800 Series IP Phones - CVE-2018-0325
Published: May 17, 2018 / Updated: May 17, 2018
Vulnerability identifier: #VU12788
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-0325
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Cisco 7800 Series IP Phones
Cisco 6800 Series IP Phones
Cisco 7800 Series IP Phones
Cisco 6800 Series IP Phones
Software vendor:
Cisco Systems, Inc
Cisco Systems, Inc
Description
The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.
The weakness exists in the Session Initiation Protocol (SIP) call-handling functionality due to incomplete input validation of SIP Session Description Protocol (SDP) parameters by the SDP parser. A remote attacker can send a specially crafted SIP packet, cause all active phone calls on the affected phone to be dropped while the SIP process on the phone unexpectedly restarts and cause the service to crash.
Remediation
Update to version 12.1(1)MN130.