Cisco Session Initiation Protocol Sip Software
Monthly
Memory exhaustion via crafted HTTP stream causes a persistent denial of service on Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running Cisco SIP Software, requiring a manual reboot to recover. The root cause is CWE-401 (missing release of memory after effective lifetime) in the device's HTTP packet processing path: an attacker sends a continuous stream of specially crafted HTTP packets, causing the phone to leak memory until it becomes unavailable. Exploitation is gated on a non-default configuration - Web Access must be explicitly enabled on devices registered to Cisco Unified Communications Manager - materially limiting real-world attack surface despite the network-accessible vector. No public exploit code and no CISA KEV listing were identified at time of analysis.
Memory exhaustion via crafted HTTP stream causes a persistent denial of service on Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running Cisco SIP Software, requiring a manual reboot to recover. The root cause is CWE-401 (missing release of memory after effective lifetime) in the device's HTTP packet processing path: an attacker sends a continuous stream of specially crafted HTTP packets, causing the phone to leak memory until it becomes unavailable. Exploitation is gated on a non-default configuration - Web Access must be explicitly enabled on devices registered to Cisco Unified Communications Manager - materially limiting real-world attack surface despite the network-accessible vector. No public exploit code and no CISA KEV listing were identified at time of analysis.