cisco-sa-sip-Cv28sQw2: Cisco IOS and IOS XE Software Session Initiation Protocol Denial of Service Vulnerability
First published: Wed Jun 03 2020(Updated: )
A vulnerability in the Session Initiation Protocol (SIP) library of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient sanity checks on received SIP messages. An attacker could exploit this vulnerability by sending crafted SIP messages to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sip-Cv28sQw2 This advisory is part of the June 3, 2020, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 23 Cisco Security Advisories that describe 25 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: June 2020 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication.
Credit: This vulnerability was found by Puspalatha S Cisco during internal security testing
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS | ||
| Cisco IOS XE Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-sip-Cv28sQw2?
The severity of cisco-sa-sip-Cv28sQw2 is critical, as it can lead to a denial of service condition.
How do I fix cisco-sa-sip-Cv28sQw2?
To mitigate cisco-sa-sip-Cv28sQw2, it is recommended to update to the patched versions of Cisco IOS Software or Cisco IOS XE Software.
What devices are affected by cisco-sa-sip-Cv28sQw2?
cisco-sa-sip-Cv28sQw2 affects devices running Cisco IOS Software and Cisco IOS XE Software.
Can cisco-sa-sip-Cv28sQw2 be exploited remotely?
Yes, cisco-sa-sip-Cv28sQw2 can be exploited remotely by an unauthenticated attacker.
What impact does cisco-sa-sip-Cv28sQw2 have on affected systems?
The impact of cisco-sa-sip-Cv28sQw2 on affected systems is a potential reload of the device, leading to service interruption.
- agent/event
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/author
- agent/title
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios
- canonical/cisco ios xe software