Skip to main content

Telepresence Video Communication Server CVE-2019-1721

MEDIUM
Improper Input Validation (CWE-20)
2019-04-18 psirt@cisco.com
Denial Of Service Cisco Telepresence Video Communication Server
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Apr 18, 2019 - 01:29 nvd
MEDIUM 6.5

DescriptionNVD

A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a Session Initiation Protocol (SIP) message with a crafted XML payload to an affected device. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition. Manual intervention may be required to recover the device. This vulnerability is fixed in Cisco Expressway Series and Cisco TelePresence Video Communication Server Releases X12.5.1 and later.

AnalysisAI

A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a Session Initiation Protocol (SIP) message with a crafted XML payload to an affected device. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition. Manual intervention may be required to recover the device. This vulnerability is fixed in Cisco Expressway Series and Cisco TelePresence Video Communication Server Releases X12.5.1 and later. Affected products include: Cisco Telepresence Video Communication Server.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Telepresence Video Communication Server

View all
CVE-2016-1468 HIGH
8.8 Aug 08

The administrative web interface in Cisco TelePresence Video Communication Server Expressway X8.5.2 allows remote authen
CVE-2017-3790 HIGH
8.6 Feb 01

A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Serv
CVE-2019-1845 HIGH
8.6 Jun 05

A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM
CVE-2012-0330 HIGH
7.8 Mar 01

Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of s
CVE-2023-20192 HIGH
7.7 Jun 28

Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow

CVE-2016-1400 HIGH
7.5 May 25

Cisco TelePresence Video Communications Server (VCS) X8.x before X8.7.2 allows remote attackers to cause a denial of ser
CVE-2012-0331 HIGH
7.5 Mar 01

Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of s
CVE-2020-3596 HIGH
7.5 Oct 08

A vulnerability in the Session Initiation Protocol (SIP) of Cisco Expressway Series and Cisco TelePresence Video Communi
CVE-2018-0409 HIGH
7.5 Aug 15

A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P)

CVE-2018-0358 HIGH
7.5 Jun 21

A vulnerability in the file descriptor handling of Cisco TelePresence Video Communication Server (VCS) Expressway could

CVE-2023-20209 HIGH
7.2 Aug 16

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communicat
CVE-2022-20755 HIGH
7.2 Apr 06

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresenc

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2019-1721 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy