CVE-2014-2156: Input Validation
Published May 2, 2014
·Updated
Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45739.
Affected Software
44 affected components
Cisco TelePresence System Software<=f9.3
Cisco TelePresence System Software=f9.0.1
Cisco TelePresence System Software=f9.0.2
Cisco TelePresence System Software=f9.1.0
Cisco TelePresence System Software=f9.1.1
Cisco TelePresence System Software=f9.1.2
Cisco TelePresence System Software=fnc9.1.0
Cisco TelePresence System Software=fnc9.1.1
Cisco TelePresence System Software=fnc9.1.2
Cisco TelePresence System Software=fnc9.3
Cisco Tandberg 2000 Mxp
Cisco Tandberg 550 Mxp
Cisco Tandberg 770 Mxp
Cisco Tandberg 880 Mxp
Cisco Tandberg 990 Mxp
Cisco Telepresence System 1000 Mxp
Cisco Telepresence System 1700 Mxp
Cisco Telepresence System Codec 3000 Mxp
Cisco Telepresence System Codec 6000 Mxp
Cisco Telepresence System Edge 75 Mxp
Cisco Telepresence System Edge 85 Mxp
Cisco Telepresence System Edge 95 Mxp
All of the following
Any of the following
Cisco TelePresence System Software<=f9.3
Cisco TelePresence System Software=f9.0.1
Cisco TelePresence System Software=f9.0.2
Cisco TelePresence System Software=f9.1.0
Cisco TelePresence System Software=f9.1.1
Cisco TelePresence System Software=f9.1.2
Cisco TelePresence System Software=fnc9.1.0
Cisco TelePresence System Software=fnc9.1.1
Cisco TelePresence System Software=fnc9.1.2
Cisco TelePresence System Software=fnc9.3
Any of the following
Cisco Tandberg 2000 Mxp
Cisco Tandberg 550 Mxp
Cisco Tandberg 770 Mxp
Cisco Tandberg 880 Mxp
Cisco Tandberg 990 Mxp
Cisco Telepresence System 1000 Mxp
Cisco Telepresence System 1700 Mxp
Cisco Telepresence System Codec 3000 Mxp
Cisco Telepresence System Codec 6000 Mxp
Cisco Telepresence System Edge 75 Mxp
Cisco Telepresence System Edge 85 Mxp
Cisco Telepresence System Edge 95 Mxp
Event History
May 2, 2014
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Data Sourced
via NVD·10:55 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2156?
CVE-2014-2156 is classified as a denial of service vulnerability that can cause the device to reload.
2
How do I fix CVE-2014-2156?
To mitigate CVE-2014-2156, upgrade the Cisco TelePresence System MXP Series Software to version F9.3.1 or later.
3
What products are affected by CVE-2014-2156?
CVE-2014-2156 affects various versions of the Cisco TelePresence System MXP Series Software prior to F9.3.1.
4
What is the nature of the attack associated with CVE-2014-2156?
The vulnerability allows remote attackers to exploit crafted SIP packets to trigger device reloads.
5
Is there a workaround for CVE-2014-2156?
There are no documented workarounds for CVE-2014-2156; upgrading the software is the only solution.