CVE-2017-12260

CVSS V2 Medium 5 CVSS V3 High 7.5
Description
A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this vulnerability by using formatted specifiers in a SIP payload that is sent to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. This vulnerability affects Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones that are running firmware release 7.6.2SR1 or earlier. Cisco Bug IDs: CSCvc63986.
Overview
  • CVE ID
  • CVE-2017-12260
  • Assigner
  • ykramarz@cisco.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2017-10-19T08:29:00
  • Last Modified Date
  • 2019-10-09T23:22:46
Weakness Enumerations
CWE URL
CWE-119 http://cwe.mitre.org/data/definitions/119.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:o:cisco:spa_501g_firmware:*:sr1:*:*:*:*:*:* 1 OR 7.6.2
cpe:2.3:h:cisco:spa_501g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cisco:spa_502g_firmware:*:sr1:*:*:*:*:*:* 1 OR 7.6.2
cpe:2.3:h:cisco:spa_502g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cisco:spa_504g_firmware:*:sr1:*:*:*:*:*:* 1 OR 7.6.2
cpe:2.3:h:cisco:spa_504g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cisco:spa_508g_firmware:*:sr1:*:*:*:*:*:* 1 OR 7.6.2
cpe:2.3:h:cisco:spa_508g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cisco:spa_509g_firmware:*:sr1:*:*:*:*:*:* 1 OR 7.6.2
cpe:2.3:h:cisco:spa_509g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cisco:spa_512g_firmware:*:sr1:*:*:*:*:*:* 1 OR 7.6.2
cpe:2.3:h:cisco:spa_512g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cisco:spa_514g_firmware:*:sr1:*:*:*:*:*:* 1 OR 7.6.2
cpe:2.3:h:cisco:spa_514g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:cisco:spa_525g_firmware:*:sr1:*:*:*:*:*:* 1 OR 7.6.2
cpe:2.3:h:cisco:spa_525g:-:*:*:*:*:*:*:* 0 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:N/C:N/I:N/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • NONE
  • Availability Impact
  • PARTIAL
  • Base Score
  • 5
  • Severity
  • MEDIUM
  • Exploitability Score
  • 10
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.0
  • Vector String
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • NONE
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • NONE
  • Availability Impact
  • HIGH
  • Base Score
  • 7.5
  • Base Severity
  • HIGH
  • Exploitability Score
  • 3.9
  • Impact Score
  • 3.6
References
Reference URL Reference Tags
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1 Vendor Advisory
http://www.securitytracker.com/id/1039616 Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/101495 Third Party Advisory VDB Entry
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2017-12260
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12260
History
Created Old Value New Value Data Type Notes
2022-05-10 17:12:09 Added to TrackCVE
2022-12-02 22:06:56 psirt@cisco.com ykramarz@cisco.com CVE Assigner updated
2022-12-02 22:06:56 2017-10-19T08:29Z 2017-10-19T08:29:00 CVE Published Date updated
2022-12-02 22:06:56 2019-10-09T23:22:46 CVE Modified Date updated
2022-12-02 22:06:56 Modified Vulnerability Status updated