CVE-2019-1721

A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a Session Initiation Protocol (SIP) message with a crafted XML payload to an affected device. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition. Manual intervention may be required to recover the device. This vulnerability is fixed in Cisco Expressway Series and Cisco TelePresence Video Communication Server Releases X12.5.1 and later.

• CWE-20
• CWE-20

• http://www.securityfocus.com/bid/108016Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-es-tvcs-dosVendor Advisory
• http://www.securityfocus.com/bid/108016Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-es-tvcs-dosVendor Advisory

Published

Apr 18, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17202FastTrack Admin By Request 6.1.0.0 supports group policies t…7.8
• CVE-2019-17203TeamPass 2.1.27.36 allows Stored XSS at the Search page by s…5.4
• CVE-2019-17204TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Kn…5.4
• CVE-2019-17205TeamPass 2.1.27.36 allows Stored XSS by placing a payload in…6.1
• CVE-2019-17206Uncontrolled deserialization of a pickled object in models.p…9.8
• CVE-2019-17207A reflected XSS vulnerability was found in includes/admin/ta…5.4
• CVE-2019-17210A denial-of-service issue was discovered in the MQTT library…7.5
• CVE-2019-17211An integer overflow was discovered in the CoAP library in Ar…9.8
• CVE-2019-17212Buffer overflows were discovered in the CoAP library in Arm …9.8
• CVE-2019-17213The WebARX plugin 1.3.0 for WordPress has unauthenticated st…6.1
• CVE-2019-17214The WebARX plugin 1.3.0 for WordPress allows firewall bypass…7.5
• CVE-2019-17215An issue was discovered on V-Zug Combi-Steam MSLQ devices be…9.8