CVE-2015-6360

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-04-21 · updated 2026-06-17
Weakness: CWE-119

Description

The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686.

Affected products

Cisco ASA Software: 8.1.0.104, 8.2.0.45, 8.2.1, 8.2.1.11, 8.2.2, 8.2.2.9 (+155)
Cisco Dx Series Ip Phones Firmware: 9.3(2)
Cisco IOS XE: 3.10s_3.10.0s, 3.10s_3.10.1s, 3.10s_3.10.1xbs, 3.10s_3.10.2s, 3.10s_3.10.2ts, 3.10s_3.10.4s (+14)
Cisco Ip Phone 7800 Series Firmware: 10.3(1)
Cisco IP Phone 8800 Series: 10.3(2), 11.0(1)
Cisco Jabber Software Development Kit: 8.6(1), 9.0(1), 9.2(0), 9.2(1), 9.2(2), 9.2(3) (+7)
Cisco Libsrtp: through 1.5.2
Cisco Unified Communications Manager: 9.9(9)st1.9
Cisco Unified Ip Phone 6900 Series Firmware: 9.3(2)
Cisco Unified Ip Phone 7900 Series Firmware: 9.9(9.99001.1), 9.9_base
Cisco Unified Ip Phone 8900 Series Firmware: 9.0(1)sr1, 9.0(3), 9.0(4), 9.1(1)sr1, 9.1(2), 9.2(1) (+11)
Cisco Unified Wireless Ip Phone 7920 Firmware: 1.0(5), 1.0(6), 1.0(7), 1.0(8), 1.0(9), 1.0_base (+1)
Cisco Unity Connection: 1.1(1), 1.2_base, 2.0(1), 2.0_base, 2.1_base, 7.0_base (+57)
Cisco WebEx Meeting Center: base

References

Get alerted when CVE-2015-6360 or the next vulnerability affects your stack