CVE-2020-3255
HighCVSS 7.5Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. It is due to inefficient memory management. An attacker could exploit this by sending a high rate of IPv4 or IPv6 traffic through the device, which must match a configured block action in an access control policy.
Risk Assessment
The exploit could lead to memory exhaustion on the device, causing traffic disruption and sluggish management interface performance. This could impact network operations and service availability.
Recommendation
Apply updates provided by Cisco for FTD software. Monitor network traffic for anomalies and consider rate limiting to reduce the risk of exploitation.
Other vulnerabilities in Cisco Firepower Threat Defense (FTD) Software
See all- CVE-2024-20407Medium
A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies. The issue is due to a logic error when handling embryonic (half-open) TCP connections. Devices configured with Snort 2 are not affected.
- CVE-2024-20339High
A vulnerability in the TLS processing feature of Cisco Firepower Threat Defense (FTD) Software for Firepower 2100 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue occurs when processing TLS traffic, and exploitation by sending certain TLS traffic over IPv4 could cause the device to reload, impacting traffic through the device.
- CVE-2024-20330High
A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause memory corruption, leading to unexpected Snort detection engine restarts. The issue is due to improper memory management when processing specific TCP or UDP packets. Exploitation can cause repeated restarts, resulting in a DoS condition.
- CVE-2024-20261Medium
A vulnerability in the file policy feature used to inspect encrypted archive files of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured file policy to block an encrypted archive file. The issue is due to a logic error when a specific class of encrypted archive files is inspected.
- CVE-2023-20083High
A vulnerability in ICMPv6 inspection when configured with the Snort 2 detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause CPU usage to spike to 100%, stopping all traffic processing and resulting in a DoS condition. The issue is due to improper error checking when parsing ICMPv6 header fields. Sending a crafted ICMPv6 packet can exhaust CPU resources and stop traffic processing.
- CVE-2022-20950Medium
A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This is due to a lack of error-checking when SIP bidirectional flows are inspected by Snort 3. An attacker could exploit this by sending crafted SIP traffic, leading to a denial of service (DoS) condition.
- CVE-2022-20949Medium
A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system. This is due to improper restriction of access to HTTPS endpoints. An attacker could exploit this by sending specific messages to the HTTPS handler, allowing configuration changes that should only be performed through Firepower Management Center (FMC).
- CVE-2022-20767High
A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. It is due to improper handling of the DNS reputation enforcement rule. An attacker could exploit this by sending crafted UDP packets through the device to force a buildup of UDP connections. This only affects FTD devices running Snort 3.
- CVE-2022-20751High
A vulnerability in the Snort detection engine integration for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause unlimited memory consumption, leading to DoS. It is due to insufficient memory management for certain Snort events. An attacker can send crafted IP packets to generate specific Snort events, causing out-of-memory and traffic interruption; in some cases, device reload may occur.
- CVE-2021-34781High
A vulnerability in SSH connection processing for multi-instance deployments of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a DoS condition. It is due to improper error handling when an SSH session fails. An attacker can send a high rate of crafted SSH connections, leading to resource exhaustion and DoS; manual reload is required.
Original NVD description (English source)
A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to inefficient memory management. An attacker could exploit this vulnerability by sending a high rate of IPv4 or IPv6 traffic through an affected device. This traffic would need to match a configured block action in an access control policy. An exploit could allow the attacker to cause a memory exhaustion condition on the affected device, which would result in a DoS for traffic transiting the device, as well as sluggish performance of the management interface. Once the flood is stopped, performance should return to previous states.