// For flags

CVE-2020-3163

Cisco Unified Contact Center Enterprise Denial of Service Vulnerability

Severity Score

5.9
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the Live Data server of Cisco Unified Contact Center Enterprise could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists because the affected software improperly manages resources when processing inbound Live Data traffic. An attacker could exploit this vulnerability by sending multiple crafted Live Data packets to an affected device. A successful exploit could cause the affected device to run out of buffer resources, which could result in a stack overflow and cause the affected device to reload, resulting in a DoS condition. Note: The Live Data port in Cisco Unified Contact Center Enterprise devices allows only a single TCP connection. To exploit this vulnerability, an attacker would have to send crafted packets to an affected device before a legitimate Live Data client establishes a connection.

Una vulnerabilidad en el servidor Live Data de Cisco Unified Contact Center Enterprise, podría permitir a un atacante remoto no autenticado causar una condición de denegación de servicio (DoS) en un dispositivo afectado. La vulnerabilidad se presenta porque el software afectado gestiona los recursos de manera inapropiada al procesar el tráfico entrante Live Data. Un atacante podría explotar esta vulnerabilidad mediante el envío de múltiples paquetes Live Data diseñados hacia un dispositivo afectado. Una explotación con éxito podría causar que el dispositivo afectado se ejecute fuera de los recursos del búfer, lo que podría resultar en un desbordamiento de la pila y causar que el dispositivo afectado se recargue, resultando en una condición de DoS. Nota: El puerto Live Data en dispositivos Cisco Unified Contact Center Enterprise solo permite una única conexión TCP. Para explotar esta vulnerabilidad, un atacante tendría que enviar paquetes diseñados hacia un dispositivo afectado antes de que un cliente legítimo de Live Data establezca una conexión.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-12-12 CVE Reserved
  • 2020-02-19 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Unified Contact Center Enterprise
Search vendor "Cisco" for product "Unified Contact Center Enterprise"
 < 12.5\(1\)
Search vendor "Cisco" for product "Unified Contact Center Enterprise" and version " < 12.5\(1\)"
-
Affected