VulnerabilityModified

CVE-2018-0086

HIGH 8.6EPSS 2.30%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A vulnerability in the application server of the Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to malformed SIP INVITE traffic received on the CVP during communications with the Cisco Virtualized Voice Browser (VVB). An attacker could exploit this vulnerability by sending malformed SIP INVITE traffic to the targeted appliance. An exploit could allow the attacker to impact the availability of services and data on the device, causing a DoS condition. This vulnerability affects Cisco Unified CVP running any software release prior to 11.6(1). Cisco Bug IDs: CSCve85840.

CVSS 3.0: 8.6 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS: 2.30% probability · 83th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-400
Affected: cisco/unified customer voice portal
Source: psirt@cisco.com

EPSS trend

EPSS 2.3% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://www.securityfocus.com/bid/102745Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040220Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-cvpVendor Advisory
http://www.securityfocus.com/bid/102745Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040220Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-cvpVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.