CVE-2009-2051 json
Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka…
published 2009-08-27 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-2047
- cvss
- 7.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.4%
- EPSS 3.4% chance of exploitation in 30 days, percentile 89%
- public exploits
- 0
- none known
Summary
Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), and 7.x before 7.1(2) allow remote attackers to cause a denial of service (device reload or voice-services outage) via a malformed SIP INVITE message that triggers an improper call to the sipSafeStrlen function, aka Bug IDs CSCsz40392 and CSCsz43987.
Patch / fix
- cisco unified_communications_manager 5.1\(3g\), 6.1\(4\), 7.1\(2\)
Exploit prediction
3.44% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.8 | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Classification
- Technology feeds
References
-
cisco.com
/en/US/products/products_security_advisory09186a0080af2d11.shtml
vendor-advisory, patch
-
cisco.com
/en/US/products/products_security_advisory09186a0080b4a30f.shtml
vendor-advisory
-
osvdb.org
/57453
vdb-entry, broken-link
-
secunia.com
/advisories/36499
third-party-advisory
-
securityfocus.com
/bid/36152
vdb-entry, third-party-advisory
-
secunia.com
/advisories/36498
third-party-advisory
-
securitytracker.com
/id?1022775
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2009-2051
- NVD CVE-2009-2051
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.