Vulnerability Description
A vulnerability in the common Session Initiation Protocol (SIP) library of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient sanity checks on an internal data structure. An attacker could exploit this vulnerability by sending a sequence of malicious SIP messages to an affected device. An exploit could allow the attacker to cause a NULL pointer dereference, resulting in a crash of the iosd process. This triggers a reload of the device.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ios Xe | 15.6\(1\)s4.2 |
| Cisco | 1000 Integrated Services Router | - |
| Cisco | 1100 Integrated Services Router | - |
| Cisco | 4000 Integrated Services Router | - |
| Cisco | 4221 Integrated Services Router | - |
| Cisco | 4321 Integrated Services Router | - |
| Cisco | 4331 Integrated Services Router | - |
| Cisco | 4351 Integrated Services Router | - |
| Cisco | 4431 Integrated Services Router | - |
| Cisco | 4451-X Integrated Services Router | - |
| Cisco | Asr 1000 | - |
| Cisco | Asr 1001-Hx | - |
| Cisco | Asr 1001-X | - |
| Cisco | Asr 1002-Hx | - |
| Cisco | Asr 1002-X | - |
| Cisco | Cloud Services Router 1000V | - |
| Cisco | Integrated Services Virtual Router | - |
Related Weaknesses (CWE)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory
FAQ
What is CVE-2019-12654?
CVE-2019-12654 is a vulnerability with a CVSS score of 7.5 (HIGH). A vulnerability in the common Session Initiation Protocol (SIP) library of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resu...
How severe is CVE-2019-12654?
CVE-2019-12654 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-12654?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ios Xe, Cisco 1000 Integrated Services Router, Cisco 1100 Integrated Services Router, Cisco 4000 Integrated Services Router, Cisco 4221 Integrated Services Router.