CVE-2018-15462
HighCVSS 8.6Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
A vulnerability in the TCP ingress handler for data interfaces configured with management access in Cisco FTD Software could allow an unauthenticated, remote attacker to cause an increase in CPU and memory usage, resulting in a DoS condition. The issue is due to insufficient ingress TCP rate limiting for TCP ports 22 (SSH) and 443 (HTTPS). An attacker could exploit this by sending a crafted, steady stream of TCP traffic to port 22 or 443 on data interfaces with management access.
Risk Assessment
The risk is the potential for device overload, leading to performance degradation and possible service disruptions.
Recommendation
Update FTD software to patched versions and implement rate limiting for TCP traffic on management ports.
Other vulnerabilities in Cisco Firepower Threat Defense (FTD)
See all- CVE-2019-1704High
Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco FTD Software could allow an unauthenticated, adjacent or remote attacker to cause a DoS condition. For more information, see the Details section of the Cisco advisory.
- CVE-2019-1703High
A vulnerability in the internal packet-processing functionality of Cisco FTD Software for Firepower 2100 Series could allow an unauthenticated, remote attacker to cause the device to stop processing traffic, resulting in a DoS condition. The issue is due to a logic error that may prevent ingress buffers from being replenished under specific traffic conditions. An attacker could exploit this by sending a series of crafted packets, potentially exhausting all input buffers and causing a queue wedge in all active interfaces.
Original NVD description (English source)
A vulnerability in the TCP ingress handler for the data interfaces that are configured with management access to Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an increase in CPU and memory usage, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient ingress TCP rate limiting for TCP ports 22 (SSH) and 443 (HTTPS). An attacker could exploit this vulnerability by sending a crafted, steady stream of TCP traffic to port 22 or 443 on the data interfaces that are configured with management access to the affected device.