Vulnerability Details CVE-2019-12654
A vulnerability in the common Session Initiation Protocol (SIP) library of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient sanity checks on an internal data structure. An attacker could exploit this vulnerability by sending a sequence of malicious SIP messages to an affected device. An exploit could allow the attacker to cause a NULL pointer dereference, resulting in a crash of the iosd process. This triggers a reload of the device.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.012
EPSS Ranking 77.5%
CVSS Severity
CVSS v3 Score 8.6
CVSS v2 Score 7.8
References
Products affected by CVE-2019-12654
-
cpe:2.3:h:cisco:1000_integrated_services_router:-
-
cpe:2.3:h:cisco:1100_integrated_services_router:-
-
cpe:2.3:h:cisco:4000_integrated_services_router:-
-
cpe:2.3:h:cisco:4221_integrated_services_router:-
-
cpe:2.3:h:cisco:4321_integrated_services_router:-
-
cpe:2.3:h:cisco:4331_integrated_services_router:-
-
cpe:2.3:h:cisco:4351_integrated_services_router:-
-
cpe:2.3:h:cisco:4431_integrated_services_router:-
-
cpe:2.3:h:cisco:4451-x_integrated_services_router:-
-
cpe:2.3:h:cisco:asr_1000:-
-
cpe:2.3:h:cisco:asr_1001-hx:-
-
cpe:2.3:h:cisco:asr_1001-x:-
-
cpe:2.3:h:cisco:asr_1002-hx:-
-
cpe:2.3:h:cisco:asr_1002-x:-
-
cpe:2.3:h:cisco:cloud_services_router_1000v:-
-
cpe:2.3:h:cisco:integrated_services_virtual_router:-
-
cpe:2.3:o:cisco:ios_xe:15.6(1)s4.2
-
cpe:2.3:o:cisco:ios_xe:16.3.8
-
cpe:2.3:o:cisco:ios_xe:16.9.1