CVE-2019-12646: Cisco IOS XE Software NAT Session Initiation Protocol Application Layer Gateway Denial of Service Vulnerability
First published: Wed Sep 25 2019(Updated: )
A vulnerability in the Network Address Translation (NAT) Session Initiation Protocol (SIP) Application Layer Gateway (ALG) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper processing of transient SIP packets on which NAT is performed on an affected device. An attacker could exploit this vulnerability by using UDP port 5060 to send crafted SIP packets through an affected device that is performing NAT for SIP packets. A successful exploit could allow an attacker to cause the device to reload, resulting in a denial of service (DoS) condition.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE | =15.4\(3\)s | |
| Cisco IOS XE | =15.5\(3\)s | |
| Cisco IOS XE | =15.6\(1\)s | |
| Cisco IOS XE | =16.3.1 | |
| Cisco IOS XE | =16.4.1 | |
| Cisco IOS XE | =16.5.1 | |
| Cisco IOS XE | =16.6.1 | |
| Cisco IOS XE | =16.7.1 | |
| Cisco IOS XE | =16.8.1 | |
| Cisco IOS XE | =16.9.1 | |
| Cisco IOS XE | =16.10.1 | |
| Cisco IOS XE | =16.11.1 | |
| Cisco IOS XE | =16.12.1 | |
| Cisco 1100-4p | ||
| Cisco 1100-8p | ||
| Cisco 1101-4p | ||
| Cisco 1109-2p | ||
| Cisco 1109-4p | ||
| Cisco 1111x-8p | ||
| Cisco 4221 Integrated Services Router | ||
| Cisco 4331 Integrated Services Router | ||
| Cisco Csr 1000v | ||
| Cisco Encs 5100 | ||
| Cisco Encs 5400 | ||
| Cisco Isrv |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-12646?
CVE-2019-12646 is a vulnerability in the Network Address Translation (NAT) Session Initiation Protocol (SIP) Application Layer Gateway (ALG) of Cisco IOS XE Software that allows an unauthenticated, remote attacker to cause a device reload.
How severe is CVE-2019-12646?
CVE-2019-12646 has a severity rating of 7.5 out of 10 (high severity).
Which versions of Cisco IOS XE Software are affected by CVE-2019-12646?
Versions 15.4(3)s to 16.12.1 of Cisco IOS XE Software are affected by CVE-2019-12646.
How can an attacker exploit CVE-2019-12646?
An attacker can exploit CVE-2019-12646 by sending specially crafted SIP traffic to the vulnerable device.
Is there a fix for CVE-2019-12646?
Yes, Cisco has released software updates to address the vulnerability in affected versions of Cisco IOS XE Software.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- vendor/cisco
- canonical/cisco ios xe
- version/cisco ios xe/15.4\(3\)s
- version/cisco ios xe/15.5\(3\)s
- version/cisco ios xe/15.6\(1\)s
- version/cisco ios xe/16.3.1
- version/cisco ios xe/16.4.1
- version/cisco ios xe/16.5.1
- version/cisco ios xe/16.6.1
- version/cisco ios xe/16.7.1
- version/cisco ios xe/16.8.1
- version/cisco ios xe/16.9.1
- version/cisco ios xe/16.10.1
- version/cisco ios xe/16.11.1
- version/cisco ios xe/16.12.1
- canonical/cisco 1100-4p
- canonical/cisco 1100-8p
- canonical/cisco 1101-4p
- canonical/cisco 1109-2p
- canonical/cisco 1109-4p
- canonical/cisco 1111x-8p
- canonical/cisco 4221 integrated services router
- canonical/cisco 4331 integrated services router
- canonical/cisco csr 1000v
- canonical/cisco encs 5100
- canonical/cisco encs 5400
- canonical/cisco isrv