What is the CVSS score of CVE-2012-5445?

CVE-2012-5445 has a CVSS 2.0 base score of 6.8 (Medium). CVSS vector: AV:L/AC:L/Au:S/C:C/I:C/A:C. EPSS exploitation probability: 0.4%.

Skinny Client Control Protocol Software CVE-2012-5445

MEDIUM

Improper Input Validation (CWE-20)

2012-12-28 psirt@cisco.com

RCE Denial Of Service Cisco Skinny Client Control Protocol Software Unified Ip Phone Unified Ip Phone 7906G

6.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:L/AC:L/Au:S/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:L/Au:S/C:C/I:C/A:C

Attack Vector

Local

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Dec 28, 2012 - 11:48 cve.org

MEDIUM 6.8

DescriptionCVE.org

The kernel in Cisco Native Unix (CNU) on Cisco Unified IP Phone 7900 series devices (aka TNP phones) with software before 9.3.1-ES10 does not properly validate unspecified system calls, which allows attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a crafted binary.

AnalysisAI

The kernel in Cisco Native Unix (CNU) on Cisco Unified IP Phone 7900 series devices (aka TNP phones) with software before 9.3.1-ES10 does not properly validate unspecified system calls, which allows. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. The kernel in Cisco Native Unix (CNU) on Cisco Unified IP Phone 7900 series devices (aka TNP phones) with software before 9.3.1-ES10 does not properly validate unspecified system calls, which allows attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a crafted binary. Affected products include: Cisco Skinny Client Control Protocol Software, Cisco Unified Ip Phone, Cisco Unified Ip Phone 7906G. Version information: before 9.3.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.