A vulnerability in the handling of IP fragments for the Cisco Small Business SPA300, SPA500, and SPA51x Series IP Phones could allow an…

Description

A vulnerability in the handling of IP fragments for the Cisco Small Business SPA300, SPA500, and SPA51x Series IP Phones could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to the inability to handle many large IP fragments for reassembly in a short duration. An attacker could exploit this vulnerability by sending a crafted stream of IP fragments to the targeted device. An exploit could allow the attacker to cause a DoS condition when the device unexpectedly reloads. Cisco Bug IDs: CSCve82586.

Scores

EPSS (exploitation in 30 days)

2.7% · top 14% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-399 (opens in a new tab)All about CWE-399 and its CVEs

Affected products

• Cisco Small Business SPA300, SPA500, and SPA51x Series IP Phones

  • affected Cisco Small Business SPA300, SPA500, and SPA51x Series IP Phones

References (3)

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-spa (opens in a new tab)x_refsource_CONFIRMx_transferred
• 100926 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 1039413 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2017-12219](https://trackcve.app/badge/CVE-2017-12219.svg)](https://trackcve.app/cve/CVE-2017-12219)

Record last updated 5 Aug 2024, 18:28 UTC.