Unscored severity · published Aug 26, 2010
CVE-2010-2840
The Presence Engine (PE) service in Cisco Unified Presence 6.x before 6.0(7) and 7.x before 7.0(8) does not properly handle an erroneous Contact field in the header of a SIP…
–
CVSS
1.2%
EPSS
No
On KEV
Description
The Presence Engine (PE) service in Cisco Unified Presence 6.x before 6.0(7) and 7.x before 7.0(8) does not properly handle an erroneous Contact field in the header of a SIP SUBSCRIBE message, which allows remote attackers to cause a denial of service (process failure) via a malformed message, aka Bug ID CSCtd39629.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UP
Unified Presence Server · Cisco
6.0; 6.0(2); 6.0(3); 6.0(4); 6.0(5); 6.0(6); +16 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2840
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2840
Patch
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b43909.shtml
www.vupen.com
http://www.vupen.com/english/advisories/2010/2186
More from Unified Presence Server
–
CVE-2015-4220
Cross-site scripting (XSS) vulnerability in Cisco Unified Presence Server 9.1(1) allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug…
–
CVE-2014-3339
Multiple SQL injection vulnerabilities in the administrative web interface in Cisco Unified Communications Manager (CM) and Cisco Unified Presence Server (CUPS) allow remote…
–
CVE-2014-3328
The Intercluster Sync Agent Service in Cisco Unified Presence Server allows remote attackers to cause a denial of service via a TCP SYN flood, aka Bug ID CSCun34125
–
CVE-2013-6983
SQL injection vulnerability in the web interface in Cisco Unified Presence Server allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID…
–
CVE-2013-1242
Memory leak in the web framework in the server in Cisco Unified Presence (CUP) allows remote attackers to cause a denial of service (memory consumption) via malformed TCP packets,…