CVE-2020-3373
HighCVSS 8.6Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
A vulnerability in the IP fragment-handling implementation of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. This memory leak could prevent traffic from being processed, resulting in a denial of service (DoS) condition. The issue is due to improper error handling during IP fragment reassembly.
Risk Assessment
An attack could lead to continuous memory consumption and traffic processing failure, requiring a manual reboot. This can cause network outages and service unavailability.
Recommendation
Apply Cisco ASA/FTD software updates as recommended by the vendor. Monitor devices for unusual memory usage and restrict access to IP traffic from trusted sources.
Other vulnerabilities in Cisco ASA/FTD Software
See all- CVE-2023-20247Medium
A vulnerability in the remote access SSL VPN feature of Cisco ASA and FTD Software could allow an authenticated, remote attacker to bypass a configured multiple certificate authentication policy and connect using only a valid username and password. This is due to improper error handling during remote access VPN authentication. An attacker could send crafted requests during session establishment, bypassing the certificate policy while retaining privileges.
- CVE-2021-40125Medium
A vulnerability in the IKEv2 implementation of Cisco ASA and FTD Software could allow an authenticated, remote attacker to trigger a denial of service (DoS) condition. This is due to improper resource control. An attacker who can spoof a trusted IKEv2 site-to-site VPN peer and has valid credentials could send malformed, authenticated IKEv2 messages, causing a device reload.
- CVE-2021-34794Medium
A vulnerability in the SNMPv3 access control functionality of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to query SNMP data. This is due to ineffective access control. An attacker could send an SNMPv3 query from a host not permitted by the ACL and retrieve information if valid credentials are held.
- CVE-2021-34787Medium
A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco ASA and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass security protections. This is due to improper handling of network requests by devices configured with object group search. An attacker could send a specially crafted request to bypass ACL rules and send traffic to unauthorized hosts.
- CVE-2020-3585Medium
A vulnerability in the TLS handler of Cisco ASA and FTD Software for Firepower 1000 Series firewalls could allow an unauthenticated, remote attacker to gain access to sensitive information. The issue is due to improper implementation of countermeasures against the Bleichenbacher attack for RSA-based cipher suites. An attacker could send crafted TLS messages, enabling a chosen-ciphertext attack and potential decryption of previously captured TLS sessions.
- CVE-2020-3578Medium
A vulnerability in the web services interface of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked. The issue is due to insufficient URL validation when portal access rules are configured. An attacker could exploit this by accessing certain URLs on the device.
- CVE-2020-3564Medium
A vulnerability in the FTP inspection engine of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to bypass FTP inspection. The issue is due to ineffective flow tracking of FTP traffic. An attacker could exploit this by sending crafted FTP traffic through the device, allowing bypass of inspection and successful FTP connections.
- CVE-2020-3561Medium
A vulnerability in the Clientless SSL VPN (WebVPN) of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to inject arbitrary HTTP headers in responses. The issue is due to improper input sanitization. An attacker could exploit this by persuading a user to click a crafted link, enabling CRLF injection and redirecting users to arbitrary websites.
- CVE-2020-3529High
A vulnerability in the SSL VPN negotiation process for Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The issue is due to inefficient DMA memory management during SSL VPN negotiation.
- CVE-2020-3298High
A vulnerability in the OSPF implementation of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The issue is due to improper memory protection mechanisms while processing certain OSPF packets.
Original NVD description (English source)
A vulnerability in the IP fragment-handling implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. This memory leak could prevent traffic from being processed through the device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper error handling when specific failures occur during IP fragment reassembly. An attacker could exploit this vulnerability by sending crafted, fragmented IP traffic to a targeted device. A successful exploit could allow the attacker to continuously consume memory on the affected device and eventually impact traffic, resulting in a DoS condition. The device could require a manual reboot to recover from the DoS condition. Note: This vulnerability applies to both IP Version 4 (IPv4) and IP Version 6 (IPv6) traffic.