CVE-2019-1720: Cisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service Vulnerability
First published: Thu Apr 18 2019(Updated: )
A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a specifically crafted XML payload. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition until the system is manually rebooted. Software versions prior to X12.5.1 are affected.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco TelePresence Video Communication Server | <x12.5.1 | |
| <x12.5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-1720?
CVE-2019-1720 is a vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) that allows an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected system.
What is the severity of CVE-2019-1720?
The severity of CVE-2019-1720 is medium with a CVSS score of 4.9.
How does CVE-2019-1720 affect Cisco TelePresence Video Communication Server?
CVE-2019-1720 affects Cisco TelePresence Video Communication Server by causing the CPU to increase to 100% utilization, resulting in a DoS condition.
Is there a fix for CVE-2019-1720?
Yes, Cisco has released a security advisory with mitigation details and software updates to address the vulnerability. Please refer to the Cisco Security Advisory for specific instructions.
Where can I find more information about CVE-2019-1720?
You can find more information about CVE-2019-1720 in the SecurityFocus and Cisco Security Advisory links provided.
- collector/nvd-index
- agent/references
- agent/type
- agent/title
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/cisco
- canonical/cisco telepresence video communication server