CVE-2019-1703
HighCVSS 8.6Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
A vulnerability in the internal packet-processing functionality of Cisco FTD Software for Firepower 2100 Series could allow an unauthenticated, remote attacker to cause the device to stop processing traffic, resulting in a DoS condition. The issue is due to a logic error that may prevent ingress buffers from being replenished under specific traffic conditions. An attacker could exploit this by sending a series of crafted packets, potentially exhausting all input buffers and causing a queue wedge in all active interfaces.
Risk Assessment
The risk is the potential for complete traffic processing halt, requiring manual reload and causing prolonged unavailability.
Recommendation
Apply Cisco patches and monitor ingress buffer status on FTD 2100 Series devices.
Other vulnerabilities in Cisco Firepower Threat Defense (FTD)
See all- CVE-2019-1704High
Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco FTD Software could allow an unauthenticated, adjacent or remote attacker to cause a DoS condition. For more information, see the Details section of the Cisco advisory.
- CVE-2018-15462High
A vulnerability in the TCP ingress handler for data interfaces configured with management access in Cisco FTD Software could allow an unauthenticated, remote attacker to cause an increase in CPU and memory usage, resulting in a DoS condition. The issue is due to insufficient ingress TCP rate limiting for TCP ports 22 (SSH) and 443 (HTTPS). An attacker could exploit this by sending a crafted, steady stream of TCP traffic to port 22 or 443 on data interfaces with management access.
Original NVD description (English source)
A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for the Cisco Firepower 2100 Series could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulting in a denial of service (DoS) condition. The vulnerability is due to a logic error, which may prevent ingress buffers from being replenished under specific traffic conditions. An attacker could exploit this vulnerability by sending a series of crafted packets to an affected device. A successful exploit could allow the attacker to consume all input buffers, which are shared between all interfaces, leading to a queue wedge condition in all active interfaces. This situation would cause an affected device to stop processing any incoming traffic and result in a DoS condition until the device is reloaded manually.