Details of VAR-201907-0867

ID

VAR-201907-0867

CVE

CVE-2019-1922

TITLE

Cisco IP Phone 7800 and 8800 In the series NULL Pointer dereference vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-006422

DESCRIPTION

A vulnerability in Cisco SIP IP Phone Software for Cisco IP Phone 7800 Series and 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected phone. The vulnerability is due to insufficient validation of input Session Initiation Protocol (SIP) packets. An attacker could exploit this vulnerability by altering the SIP replies that are sent to the affected phone during the registration process. A successful exploit could allow the attacker to cause the phone to reboot and not complete the registration process. SIP IP Phone Software is one set of IP phone software. This issue is being tracked by Cisco Bug IDs CSCvc61672

Trust: 2.52

sources: NVD: CVE-2019-1922 // JVNDB: JVNDB-2019-006422 // CNVD: CNVD-2020-51806 // BID: 109046 // VULHUB: VHN-151644

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-51806

AFFECTED PRODUCTS

vendor:	cisco	model:	ip phone 8845	scope:	eq	version:	11.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip phone 8841	scope:	eq	version:	12.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip phone 7861	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	ip conference phone 7832	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	ip phone 8861	scope:	eq	version:	11.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip phone 8851	scope:	eq	version:	11.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip phone 7811	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	ip phone 8865	scope:	eq	version:	12.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip phone 8811	scope:	eq	version:	12.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip phone 7841	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	ip conference phone 8832	scope:	eq	version:	11.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip phone 8841	scope:	eq	version:	11.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip phone 8845	scope:	eq	version:	12.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip phone 7821	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	ip phone 8865	scope:	eq	version:	11.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip phone 8811	scope:	eq	version:	11.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip phone 8861	scope:	eq	version:	12.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip phone 8851	scope:	eq	version:	12.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip conference phone 8832	scope:	eq	version:	12.5\(1\)	Trust: 1.0
vendor:	cisco	model:	ip conference phone 7832	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ip conference phone 8832	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ip phone 7811	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ip phone 7821	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ip phone 7841	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ip phone 7861	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ip phone 8811	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ip phone 8841	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ip phone 8845	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ip phone 8851	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ip phone series	scope:	eq	version:	8800	Trust: 0.6
vendor:	cisco	model:	ip phone series none	scope:	eq	version:	7800	Trust: 0.6
vendor:	cisco	model:	unified ip conference phone for third-party call control	scope:	eq	version:	88310	Trust: 0.3
vendor:	cisco	model:	unified ip conference phone	scope:	eq	version:	88310	Trust: 0.3
vendor:	cisco	model:	ip phone with multiplatform	scope:	eq	version:	88650	Trust: 0.3
vendor:	cisco	model:	ip phone	scope:	eq	version:	88650	Trust: 0.3
vendor:	cisco	model:	ip phone	scope:	eq	version:	88610	Trust: 0.3
vendor:	cisco	model:	ip phone	scope:	eq	version:	88510	Trust: 0.3
vendor:	cisco	model:	ip phone with multiplatform	scope:	eq	version:	88450	Trust: 0.3
vendor:	cisco	model:	ip phone	scope:	eq	version:	88450	Trust: 0.3
vendor:	cisco	model:	ip phone	scope:	eq	version:	88410	Trust: 0.3
vendor:	cisco	model:	ip phone	scope:	eq	version:	88110	Trust: 0.3
vendor:	cisco	model:	ip phone series vpn feature	scope:	eq	version:	8800??0	Trust: 0.3
vendor:	cisco	model:	ip phone series	scope:	eq	version:	88000	Trust: 0.3
vendor:	cisco	model:	ip phone	scope:	eq	version:	78610	Trust: 0.3
vendor:	cisco	model:	ip phone	scope:	eq	version:	78410	Trust: 0.3
vendor:	cisco	model:	ip phone	scope:	eq	version:	78210	Trust: 0.3
vendor:	cisco	model:	ip phone	scope:	eq	version:	78110	Trust: 0.3
vendor:	cisco	model:	ip phone series with multiplatform	scope:	eq	version:	78000	Trust: 0.3
vendor:	cisco	model:	ip conference phone	scope:	eq	version:	88320	Trust: 0.3
vendor:	cisco	model:	ip conference phone	scope:	eq	version:	78320	Trust: 0.3

sources: CNVD: CNVD-2020-51806 // BID: 109046 // JVNDB: JVNDB-2019-006422 // NVD: CVE-2019-1922

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-1922
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-1922
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-1922
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-51806
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201907-226
value:	HIGH
Trust: 0.6
VULHUB:	VHN-151644
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-1922
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2020-51806
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-151644
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-1922
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.8
ykramarz@cisco.com:	CVE-2019-1922
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	1.6
impactScore:	3.6
version:	3.0
Trust: 1.0

sources: CNVD: CNVD-2020-51806 // VULHUB: VHN-151644 // JVNDB: JVNDB-2019-006422 // CNNVD: CNNVD-201907-226 // NVD: CVE-2019-1922 // NVD: CVE-2019-1922

PROBLEMTYPE DATA

problemtype:

CWE-476

Trust: 1.9

sources: VULHUB: VHN-151644 // JVNDB: JVNDB-2019-006422 // NVD: CVE-2019-1922

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201907-226

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-201907-226

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-006422

PATCH

title:	cisco-sa-20190703-ip-phone-sip-dos	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-ip-phone-sip-dos	Trust: 0.8
title:	Patch for Denial of Service Vulnerability in Cisco IP Phone 7800 and 8800 Series	url:	https://www.cnvd.org.cn/patchInfo/show/167013	Trust: 0.6
title:	Cisco IP Phone 8800 Series and Cisco IP Phone 7800 Series Fixes for code issue vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=94415	Trust: 0.6

sources: CNVD: CNVD-2020-51806 // JVNDB: JVNDB-2019-006422 // CNNVD: CNNVD-201907-226

EXTERNAL IDS

db:	NVD	id:	CVE-2019-1922	Trust: 3.4
db:	BID	id:	109046	Trust: 1.0
db:	JVNDB	id:	JVNDB-2019-006422	Trust: 0.8
db:	CNNVD	id:	CNNVD-201907-226	Trust: 0.7
db:	CNVD	id:	CNVD-2020-51806	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.2443	Trust: 0.6
db:	VULHUB	id:	VHN-151644	Trust: 0.1

sources: CNVD: CNVD-2020-51806 // VULHUB: VHN-151644 // BID: 109046 // JVNDB: JVNDB-2019-006422 // CNNVD: CNNVD-201907-226 // NVD: CVE-2019-1922

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2019-1922	Trust: 2.0
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190703-ip-phone-sip-dos	Trust: 2.0
url:	http://www.cisco.com/	Trust: 0.9
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1922	Trust: 0.8
url:	https://vigilance.fr/vulnerability/cisco-ip-phone-7800-8800-denial-of-service-via-sip-29690	Trust: 0.6
url:	https://www.securityfocus.com/bid/109046	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2019.2443/	Trust: 0.6

sources: CNVD: CNVD-2020-51806 // VULHUB: VHN-151644 // BID: 109046 // JVNDB: JVNDB-2019-006422 // CNNVD: CNNVD-201907-226 // NVD: CVE-2019-1922

CREDITS

Thomas Sabono of xen1thLabs.

Trust: 0.9

sources: BID: 109046 // CNNVD: CNNVD-201907-226

SOURCES

db:	CNVD	id:	CNVD-2020-51806
db:	VULHUB	id:	VHN-151644
db:	BID	id:	109046
db:	JVNDB	id:	JVNDB-2019-006422
db:	CNNVD	id:	CNNVD-201907-226
db:	NVD	id:	CVE-2019-1922

LAST UPDATE DATE

2024-11-23T22:06:07.776000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-51806	date:	2020-09-14T00:00:00
db:	VULHUB	id:	VHN-151644	date:	2019-10-09T00:00:00
db:	BID	id:	109046	date:	2019-07-03T00:00:00
db:	JVNDB	id:	JVNDB-2019-006422	date:	2019-07-19T00:00:00
db:	CNNVD	id:	CNNVD-201907-226	date:	2019-07-18T00:00:00
db:	NVD	id:	CVE-2019-1922	date:	2024-11-21T04:37:41.573

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-51806	date:	2019-09-07T00:00:00
db:	VULHUB	id:	VHN-151644	date:	2019-07-06T00:00:00
db:	BID	id:	109046	date:	2019-07-03T00:00:00
db:	JVNDB	id:	JVNDB-2019-006422	date:	2019-07-19T00:00:00
db:	CNNVD	id:	CNNVD-201907-226	date:	2019-07-03T00:00:00
db:	NVD	id:	CVE-2019-1922	date:	2019-07-06T02:15:11.793