Vulnerability identifier: #VU15667

Vulnerability risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:U/RC:C]

CVE-ID: CVE-2018-15454

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco Firepower 9300 Security Appliance
Hardware solutions / Security hardware applicances
Cisco 7600 Series ASA Services Module
Hardware solutions / Security hardware applicances
Cisco ASA 5500-X Series
Hardware solutions / Security hardware applicances
Cisco Firepower 4100 Series Next-Generation Firewall
Hardware solutions / Firmware
Firepower 2100 Series Security Appliance
Server applications / IDS/IPS systems, Firewalls and proxy servers
3000 Series Industrial Security Appliance (ISA)
Server applications / IDS/IPS systems, Firewalls and proxy servers
Cisco Adaptive Security Virtual Appliance (ASAv)
Server applications / Virtualization software

Vendor:
Cisco Systems, Inc

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of SIP traffic. A remote attacker can send specially crafted SIP packets to the affected device, cause high CPU load that may lead to denial of service conditions.

Note, this vulnerability is being actively exploited in the wild against a limited number of targets.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

:

Cisco Firepower 9300 Security Appliance: 1.1.3 - 2.2.1.101

Cisco Firepower 4100 Series Next-Generation Firewall: 1.1.3 - 2.2.1.101

Firepower 2100 Series Security Appliance: All versions

Cisco Adaptive Security Virtual Appliance (ASAv): All versions

Cisco 7600 Series ASA Services Module: All versions

Cisco ASA 5500-X Series: 9.1.6.11 - 9.9.2.230

3000 Series Industrial Security Appliance (ISA): All versions

---

External links
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm43975
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181031-asaftd-sip-d...

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.