What is the CVSS score of CVE-2026-0710?

CVE-2026-0710 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Suse are affected by CVE-2026-0710?

CVE-2026-0710 affects SIPp, a Session Initiation Protocol testing tool, and could allow remote attackers to disrupt or compromise active VoIP communications through malicious SIP messages.

How to fix or mitigate CVE-2026-0710?

Within 24 hours: Inventory all systems running SIPp and assess their exposure in production versus testing environments. Within 7 days: Implement network segmentation to restrict SIPp access to trusted sources only and disable SIPp if not actively required. Within 30 days: Monitor vendor security advisories for patch availability and develop a patching plan; consider migrating to alternative SIP testing tools if SIPp is not mission-critical.

Suse CVE-2026-0710

HIGH

NULL Pointer Dereference (CWE-476)

2026-01-23 patrick@puiterwijk.org

Null Pointer Dereference Denial Of Service Suse

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 04:16 nvd

HIGH 8.4

DescriptionCVE.org

A flaw was found in SIPp. A remote attacker could exploit this by sending specially crafted Session Initiation Protocol (SIP) messages during an active call. This vulnerability, a NULL pointer dereference, can cause the application to crash, leading to a denial of service. Under specific conditions, it may also allow an attacker to execute unauthorized code, compromising the system's integrity and availability.

AnalysisAI

SIPp is vulnerable to a NULL pointer dereference that can be triggered by remote attackers sending malicious SIP messages during active calls, resulting in application crashes and denial of service. Under certain conditions, this vulnerability may also enable arbitrary code execution, potentially compromising system integrity and availability. No patch is currently available.

Technical ContextAI

Classified as CWE-476 (NULL Pointer Dereference). A flaw was found in SIPp. A remote attacker could exploit this by sending specially crafted Session Initiation Protocol (SIP) messages during an active call. This vulnerability, a NULL pointer dereference, can cause the application to crash, leading to a denial of service. Under specific conditions, it may also allow an attacker to execute unauthorized code, compromising the system's integrity and availability.