CVE-2020-3596: cisco cisco telepresence video communication server (vcs) expressway

Vulnerability summary

CVE-2020-3596 is a high (CVSS 7.8) vulnerability in cisco cisco telepresence video communication server (vcs) expressway. EPSS estimates a 1.23% chance of exploitation in the next 30 days, higher than 68.4% of scored vulnerabilities.

Timeline

1. 08-10-2020
   PublishedVulnerability first disclosed.
2. 13-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the Session Initiation Protocol (SIP) of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect handling of incoming SIP traffic. An attacker could exploit this vulnerability by sending a series of SIP packets to an affected device. A successful exploit could allow the attacker to exhaust memory on an affected device, causing it to crash and leading to a DoS condition.

• CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
• CWE-670Always-Incorrect Control Flow ImplementationThe code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.