CVE-2018-0139
Published on: 02/21/2018 12:00:00 AM UTC
Last Modified on: 03/23/2021 11:24:49 PM UTC
Certain versions of Unified Customer Voice Portal from Cisco contain the following vulnerability:
A vulnerability in the Interactive Voice Response (IVR) management connection interface for Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to cause the IVR connection to disconnect, creating a system-wide denial of service (DoS) condition. The vulnerability is due to improper handling of a TCP connection request when the IVR connection is already established. An attacker could exploit this vulnerability by initiating a crafted connection to the IP address of the targeted CVP device. An exploit could allow the attacker to disconnect the IVR to CVP connection, creating a DoS condition that prevents the CVP from accepting new, incoming calls while the IVR automatically attempts to re-establish the connection to the CVP. This vulnerability affects Cisco Unified Customer Voice Portal (CVP) Software Release 11.5(1). Cisco Bug IDs: CSCve70560.
- CVE-2018-0139 has been assigned by
[email protected] to track the vulnerability - currently rated as HIGH severity.
CVSS3 Score: 8.6 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | NONE | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| CHANGED | NONE | NONE | HIGH |
CVSS2 Score: 5 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | LOW | NONE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| NONE | NONE | PARTIAL |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| Cisco Unified Customer Voice Portal CVE-2018-0139 Denial of Service Vulnerability | Third Party Advisory VDB Entry cve.report (archive) text/html |
BID 103124 |
| Cisco Unified Customer Voice Portal Interactive Voice Response Connection Denial of Service Vulnerability | Vendor Advisory tools.cisco.com text/html |
CONFIRM tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-cvp |
| Cisco Unified Customer Voice Portal IVR Connection Processing Bug Lets Remote Users Deny Service - SecurityTracker | Third Party Advisory VDB Entry www.securitytracker.com text/html |
SECTRACK 1040414 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Unified Customer Voice Portal | 11.5(1) | All | All | All |
| Application | Cisco | Unified Customer Voice Portal | 11.5\(1\) | All | All | All |
| Application | Cisco | Unified Customer Voice Portal | 11.6 | All | All | All |
| Application | Cisco | Unified Customer Voice Portal | 11.5\(1\) | All | All | All |
| Application | Cisco | Unified Customer Voice Portal | 11.6 | All | All | All |
- cpe:2.3:a:cisco:unified_customer_voice_portal:11.5(1):*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:unified_customer_voice_portal:11.5\(1\):*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:unified_customer_voice_portal:11.6:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:unified_customer_voice_portal:11.5\(1\):*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:unified_customer_voice_portal:11.6:*:*:*:*:*:*:*: