CVE-2019-12678 — Vulnetix

CVE-2019-12678 PUBLISHED CVSS 8.600000381469727 HIGH

A vulnerability in the Session Initiation Protocol (SIP) inspection module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper parsing of SIP messages. An attacker could exploit this vulnerability by sending a malicious SIP packet through an affected device. A successful exploit could allow the attacker to trigger an integer underflow, causing the software to try to read unmapped memory and resulting in a crash.

EPSS 1.05% · 77.9th percentile

Risk Scores

CVSS 3.0

8.600000381469727

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS Score

1.05%

77.9th percentile

Affected Products

Vendor	Product	Versions
cisco	adaptive_security_appliance	0
cisco	firepower_threat_defense	0, 6.4.0, 6.3.0
Cisco	Cisco Adaptive Security Appliance (ASA) Software	unspecified
cisco	adaptive_security_appliance_software	9.5, 9.7, 9.12

Exploit Intelligence

20191002 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SIP Inspection Denial of Service Vulnerability (circl)

Timeline

Oct 2, 2019 CVE Published
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Aug 24, 2021 EPSS Score
Dec 27, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Feb 28, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Jul 3, 2022 EPSS Score
Sep 4, 2022 EPSS Score
Nov 6, 2022 EPSS Score

References

Open in Interactive Console →