CVE-2018-0409

CWE-20 — Improper Input Validation CWE-125 — Out-of-bounds Read4 documents4 sources

Severity

7.5HIGH

EPSS

1.3%

top 20.12%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Systems, Inc. Telepresence Video Communication Server (vcs) AND Expressway Cisco Systems, Inc. Unified Communications Manager IM & Presence Service (cucm Im&p)Cisco Telepresence Video Communication Server +1 more

Timeline

PublishedAug 15

Latest updateMay 13

Description

A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePresence Video Communication Server (VCS) and Expressway could allow an unauthenticated, remote attacker to cause a temporary service outage for all IM&P users, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious IPv4 or IPv…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5cisco_systems,_inc./unified_communications_manager_im_&_presence_service_(cucm_im&p)unspecified

▶NVDcisco/unified_communications_manager_im_and_presence_service11.5, 11.5\(1\)+1

▶CVEListV5cisco_systems,_inc./telepresence_video_communication_server_(vcs)_and_expresswayunspecified

▶NVDcisco/telepresence_video_communication_server11 versions+10

🔴Vulnerability Details

GHSA

GHSA-qqxj-4rg7-qpmv: A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePresence Vid↗2022-05-13

▶

CVEList

CVE-2018-0409: A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePresence Vid↗2018-08-15

▶

📋Vendor Advisories

Cisco

Cisco Unified Communications Manager IM & Presence Service Denial of Service Vulnerability↗2018-08-15

▶