CVE-2010-2840
Last modified
CVE-2010-2840 is a vulnerability of currently unknown severity. The Presence Engine (PE) service in Cisco Unified Presence 6.x before 6.0(7) and 7.x before 7.0(8) does not properly handle an erroneous Contact field in the header of a SIP SUBSCRIBE message, which allows remote attackers to cause a denial of service (process failure) via a malformed message, aka Bug ID CSCtd39629.. EPSS estimates a 1.22% chance of exploitation in the next 30 days.
Description
The Presence Engine (PE) service in Cisco Unified Presence 6.x before 6.0(7) and 7.x before 7.0(8) does not properly handle an erroneous Contact field in the header of a SIP SUBSCRIBE message, which allows remote attackers to cause a denial of service (process failure) via a malformed message, aka Bug ID CSCtd39629.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Unified Presence Server | 6.0 |
| Cisco | Unified Presence Server | 6.0\(2\) |
| Cisco | Unified Presence Server | 6.0\(3\) |
| Cisco | Unified Presence Server | 6.0\(4\) |
| Cisco | Unified Presence Server | 6.0\(5\) |
| Cisco | Unified Presence Server | 6.0\(6\) |
| Cisco | Unified Presence Server | 7.0 |
| Cisco | Unified Presence Server | 7.0\(2\) |
| Cisco | Unified Presence Server | 7.0\(3\) |
| Cisco | Unified Presence Server | 7.0\(4\) |
| Cisco | Unified Presence Server | 7.0\(5\) |
| Cisco | Unified Presence Server | 7.0\(6\) |
| Cisco | Unified Presence Server | 7.0\(7\) |
| Cisco | Unified Presence Server | 6.0\(2.1101\) |
| Cisco | Unified Presence Server | 6.0\(3.1101-2\) |
| Cisco | Unified Presence Server | 6.0\(4.1101-5\) |
| Cisco | Unified Presence Server | 6.0\(5.1101-1\) |
| Cisco | Unified Presence Server | 6.0\(5.1103-2\) |
| Cisco | Unified Presence Server | 6.0.5.1102-1 |
| Cisco | Unified Presence Server | 7.0.3.10102-3 |
| Cisco | Unified Presence Server | 7.0.3.10103-2 |
| Cisco | Unified Presence Server | 7.0.4.10101-2 |
References
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080b43909.shtmlPatch, Vendor Advisory
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080b43909.shtmlPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2010-2840?
How severe is CVE-2010-2840?
How do I fix CVE-2010-2840?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2010
- CVE-2010-2834Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS…
- CVE-2010-2835Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS…
- CVE-2010-2836Memory leak in the SSL VPN feature in Cisco IOS 12.4, 15.0, …
- CVE-2010-2837The SIPStationInit implementation in Cisco Unified Communica…
- CVE-2010-2838The SendCombinedStatusInfo implementation in Cisco Unified C…
- CVE-2010-2839SIPD in Cisco Unified Presence 6.x before 6.0(7) and 7.x bef…
- CVE-2010-2841Unspecified vulnerability in Cisco Wireless LAN Controller (…
- CVE-2010-2842Cisco Wireless LAN Controller (WLC) software, possibly 4.2 t…
- CVE-2010-2843Cisco Wireless LAN Controller (WLC) software, possibly 4.2 t…
- CVE-2010-2844Cross-site scripting (XSS) vulnerability in news_show.php in…
- CVE-2010-2845SQL injection vulnerability in the QuickFAQ (com_quickfaq) c…
- CVE-2010-2846Cross-site scripting (XSS) vulnerability in the InterJoomla …
Are you affected by CVE-2010-2840?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST