CVE-2018-15383
HighCVSS 7.5Exploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
A vulnerability in the cryptographic hardware accelerator driver of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary DoS condition. The issue exists because the devices have limited DMA memory and the software improperly handles resources in low-memory conditions. An attacker could exploit this by sending sustained high-rate malicious traffic, potentially exhausting DMA memory and causing a reload.
Risk Assessment
The risk is the potential for temporary device unavailability due to reload, which may disrupt network traffic.
Recommendation
Update ASA/FTD software to patched versions and monitor DMA memory usage.
Other vulnerabilities in Cisco Adaptive Security Appliance (ASA)
See all- CVE-2015-6327High
The IKEv1 implementation in Cisco Adaptive Security Appliance (ASA) software before version 8.2(5.58), 8.3, 8.4(7.29), 8.5-8.7(1.17), 9.0(4.37), 9.1(6.8), 9.2(4), and 9.3(3) allows remote attackers to cause a denial of service (device reload) via crafted ISAKMP UDP packets.
- CVE-2015-6326High
Cisco Adaptive Security Appliance (ASA) software versions 7.2 and 8.2 before 8.2(5.58), 8.3, 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.6), 9.2 before 9.2(4), 9.3 before 9.3(3.5), and 9.4 before 9.4(1.5) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response.
- CVE-2015-6325High
Cisco Adaptive Security Appliance (ASA) software versions 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.4), 9.2 before 9.2(4), 9.3 before 9.3(3.1), and 9.4 before 9.4(1.1) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response.
- CVE-2015-6324High
The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) software before versions 9.0(4.37), 9.1(6.6), 9.2(4), 9.3(3.5), and 9.4(2) is vulnerable to remote attacks that can lead to denial of service via crafted DHCPv6 packets.
- CVE-2020-3554High
A vulnerability in the TCP packet processing of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. The issue is due to a memory exhaustion condition. An attacker could exploit this by sending a high rate of crafted TCP traffic, potentially exhausting device resources and causing DoS for transiting traffic.
- CVE-2020-3196High
A vulnerability in the SSL/TLS handler of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to exhaust memory resources on the affected device, leading to a DoS condition. The issue is due to improper resource management for inbound SSL/TLS connections. An attacker could exploit this by establishing multiple SSL/TLS connections with specific conditions, potentially exhausting memory and causing the device to stop accepting new SSL/TLS connections. Manual intervention is required to recover.
- CVE-2019-1694High
A vulnerability in the TCP processing engine of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a DoS condition. The issue is due to improper handling of TCP traffic. An attacker could exploit this by sending a specific sequence of packets at a high rate, potentially causing temporary traffic disruption during reboot.
- CVE-2019-1687High
A vulnerability in the TCP proxy functionality for Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause the device to restart unexpectedly, resulting in a DoS condition. The issue is due to an error in TCP-based packet inspection, which can cause an invalid Layer 2 header. An attacker could exploit this by sending a crafted TCP packet sequence.
- CVE-2018-0228High
A vulnerability in the ingress flow creation functionality of Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause CPU utilization to increase upwards of 100%, leading to a denial of service (DoS) condition. The issue is due to incorrect handling of an internal software lock that can prevent other system processes from getting CPU cycles. An attacker could exploit this by sending a steady stream of malicious IP packets, potentially exhausting CPU resources and causing traffic delays.
Original NVD description (English source)
A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary denial of service (DoS) condition. The vulnerability exists because the affected devices have a limited amount of Direct Memory Access (DMA) memory and the affected software improperly handles resources in low-memory conditions. An attacker could exploit this vulnerability by sending a sustained, high rate of malicious traffic to an affected device to exhaust memory on the device. A successful exploit could allow the attacker to exhaust DMA memory on the affected device, which could cause the device to reload and result in a temporary DoS condition.