CVE-2020-3304
HighCVSS 8.6Exploitation Probability (EPSS)
High risk89th percentile - higher than 89% of all known CVEs
Summary
A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could cause a DoS condition. This applies to IPv4 and IPv6 HTTP traffic.
Risk Assessment
The risk includes the possibility of device disruption, leading to unavailability of network services. The attack does not require authentication, increasing the risk of remote attack.
Recommendation
It is recommended to apply Cisco ASA/FTD software updates that contain fixes for this vulnerability. Also, monitor HTTP traffic and restrict access to the web interface.
Other vulnerabilities in Cisco ASA/FTD
See all- CVE-2024-20481MediumActively exploited
A vulnerability in the Remote Access VPN (RAVPN) service of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. The issue is due to resource exhaustion. A successful exploit could exhaust resources, resulting in DoS of the RAVPN service, and a device reload may be required to restore service.
- CVE-2024-20359MediumActively exploited
A vulnerability in a legacy capability for preloading VPN clients and plug-ins in Cisco ASA and FTD Software allows an authenticated, local attacker with administrator privileges to execute arbitrary code with root-level privileges. The issue is due to improper validation of a file read from system flash memory. A successful exploit could allow code execution after the next reload, potentially altering system behavior.
- CVE-2024-20353HighActively exploited
A vulnerability in the management and VPN web servers of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to cause an unexpected reload, resulting in DoS. The issue is due to incomplete error checking when parsing an HTTP header. A successful exploit could cause a DoS condition when the device reloads.
- CVE-2022-20759High
A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15. This vulnerability is due to improper separation of authentication and authorization scopes. An attacker could exploit this vulnerability by sending crafted HTTPS messages to the web services interface of an affected device. A successful exploit could allow the attacker to gain privilege level 15 access to the web management interface of the device, including via tools like ASDM or CSM. For FTD, the impact is lower because the management interface allows read-only access.
- CVE-2020-3580MediumActively exploited
Multiple vulnerabilities in the web services interface of Cisco ASA and FTD Software allow an unauthenticated, remote attacker to conduct XSS attacks against users of the interface. The issues are due to insufficient validation of user-supplied input. A successful exploit could allow arbitrary script execution in the interface context or access to sensitive browser-based information.
- CVE-2020-3452HighActively exploited
A vulnerability in the web services interface of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to perform directory traversal attacks and read sensitive files. The issue is due to lack of proper input validation of URLs in HTTP requests. A successful exploit allows viewing arbitrary files within the web services file system when WebVPN or AnyConnect features are enabled.
- CVE-2020-3259HighActively exploited
A vulnerability in the web services interface of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to retrieve memory contents, potentially leading to disclosure of confidential information. The issue is due to a buffer tracking issue when parsing invalid URLs. A successful exploit could allow memory contents retrieval, leading to information disclosure.
- CVE-2020-3187Critical
A vulnerability in the web services interface of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files. The issue is due to lack of proper input validation of the HTTP URL. A successful exploit could allow viewing or deleting arbitrary files in the web services file system, but files are restored after device reload.
- CVE-2018-15454High
A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload or trigger high CPU, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of SIP traffic. An attacker could exploit this vulnerability by sending SIP requests designed to trigger this issue at a high rate. Software updates addressing this vulnerability are not yet available.
- CVE-2018-0296HighActively exploited
A vulnerability in the web interface of Cisco ASA could allow an unauthenticated, remote attacker to cause an unexpected reload, resulting in DoS. In certain releases, directory traversal could also allow unauthenticated disclosure of sensitive system information. The issue is due to lack of proper input validation of the HTTP URL.
Original NVD description (English source)
A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition. Note: This vulnerability applies to IP Version 4 (IPv4) and IP Version 6 (IPv6) HTTP traffic.