Cisco Expressway Series and TelePresence Video Communication Server Denial of Service Vulnerability

Vulnerability

Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) releases up to and including X12.6.3 contain a denial-of-service vulnerability in the Session Initiation Protocol (SIP) handler [1]. The flaw is due to incorrect handling of incoming SIP traffic, allowing an unauthenticated, remote attacker to trigger memory exhaustion by sending a series of crafted SIP packets [1].

Exploitation

An attacker needs no authentication and only network access to the affected device's SIP interface. The exploit consists of repeatedly sending specially crafted SIP packets that cause the device to allocate memory without proper bounds checking until system memory is exhausted [1]. No prior access or user interaction is required, making the attack trivial to launch from a remote network position.

Impact

Successful exploitation causes complete memory exhaustion on the target device, resulting in a system crash and persistent denial of service (DoS) until the device is manually restarted [1]. The attacker does not gain code execution or data access; the impact is strictly availability loss.

Mitigation

Cisco released fixed software versions after X12.6.3; customers should upgrade to the latest available release per the advisory [1]. There are no workarounds that address this vulnerability [1]. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog.