CVE-2020-3163 Cisco Unified Contact Center Enterprise Denial of Service Vulnerability

What is CVE-2020-3163?

CVE-2020-3163 is a medium-severity vulnerability in Cisco Unified Contact Center Enterprise, published on 19 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the Live Data server of Cisco Unified Contact Center Enterprise could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists because the affected software improperly manages resources when processing inbound Live Data traffic. An attacker could exploit this vulnerability by sending multiple crafted Live Data packets to an affected device. A successful exploit could cause the affected device to run out of buffer resources, which could result in a stack overflow and cause the affected device to reload, resulting in a DoS condition. Note: The Live Data port in Cisco Unified Contact Center Enterprise devices allows only a single TCP connection. To exploit this vulnerability, an attacker would have to send crafted packets to an affected device before a legitimate Live Data client establishes a connection.

Weakness: CWE-362

Which versions are affected by CVE-2020-3163?

It affects 1 product.

Products include Cisco Unified Contact Center Enterprise.

How do I fix CVE-2020-3163?

No fix has been published for CVE-2020-3163 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-3163 being exploited?

There is no known exploitation of CVE-2020-3163 in the wild and no public exploit code.

Other vulnerabilities in Cisco Unified Contact Center Enterprise

• CVE-2007-5539 Privilege escalation in n/a Critical 9.0
• CVE-2025-20242 Missing authorization in Cisco Unified Contact Center Enterprise Medium 6.5
• CVE-2016-1439 Cross-site scripting in n/a Medium 6.1
• CVE-2017-6626 Hardcoded credentials in Cisco Finesse for Cisco Unified Contact Center Enterprise Medium 5.3
• CVE-2014-3323 Path traversal in n/a Medium 4.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-759q-wfqr-9x82.