A vulnerability in the common Session Initiation Protocol (SIP) library of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient sanity checks on an internal data structure. An attacker could exploit this vulnerability by sending a sequence of malicious SIP messages to an affected device. An exploit could allow the attacker to cause a NULL pointer dereference, resulting in a crash of the iosd process. This triggers a reload of the device.
References
| Link | Resource |
|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-sip-dos | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
22 May 2023, 18:57
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Cisco 1000 Integrated Services Router
Cisco 4000 Integrated Services Router |
|
| CPE | cpe:2.3:h:cisco:isr_4000:-:*:*:*:*:*:*:* |
cpe:2.3:h:cisco:1000_integrated_services_router:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:4000_integrated_services_router:-:*:*:*:*:*:*:* |
Information
Published : 2019-09-25 21:15
Updated : 2023-12-10 13:13
NVD link : CVE-2019-12654
Mitre link : CVE-2019-12654
CVE.ORG link : CVE-2019-12654
JSON object : View
Products Affected
cisco
- integrated_services_virtual_router
- asr_1001-hx
- 4431_integrated_services_router
- ios_xe
- 4000_integrated_services_router
- 4331_integrated_services_router
- 4451-x_integrated_services_router
- asr_1000
- asr_1002-hx
- 1000_integrated_services_router
- 4221_integrated_services_router
- 4321_integrated_services_router
- 1100_integrated_services_router
- asr_1001-x
- cloud_services_router_1000v
- 4351_integrated_services_router
- asr_1002-x
CWE
CWE-476
NULL Pointer Dereference