CVE-2020-3554
HighCVSS 7.5Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
A vulnerability in the TCP packet processing of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. The issue is due to a memory exhaustion condition. An attacker could exploit this by sending a high rate of crafted TCP traffic, potentially exhausting device resources and causing DoS for transiting traffic.
Risk Assessment
The risk is the potential for resource exhaustion, leading to network traffic disruptions and service unavailability.
Recommendation
Update ASA/FTD software to patched versions and implement rate limiting for TCP traffic.
Other vulnerabilities in Cisco Adaptive Security Appliance (ASA)
See all- CVE-2015-6327High
The IKEv1 implementation in Cisco Adaptive Security Appliance (ASA) software before version 8.2(5.58), 8.3, 8.4(7.29), 8.5-8.7(1.17), 9.0(4.37), 9.1(6.8), 9.2(4), and 9.3(3) allows remote attackers to cause a denial of service (device reload) via crafted ISAKMP UDP packets.
- CVE-2015-6326High
Cisco Adaptive Security Appliance (ASA) software versions 7.2 and 8.2 before 8.2(5.58), 8.3, 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.6), 9.2 before 9.2(4), 9.3 before 9.3(3.5), and 9.4 before 9.4(1.5) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response.
- CVE-2015-6325High
Cisco Adaptive Security Appliance (ASA) software versions 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.4), 9.2 before 9.2(4), 9.3 before 9.3(3.1), and 9.4 before 9.4(1.1) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response.
- CVE-2015-6324High
The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) software before versions 9.0(4.37), 9.1(6.6), 9.2(4), 9.3(3.5), and 9.4(2) is vulnerable to remote attacks that can lead to denial of service via crafted DHCPv6 packets.
- CVE-2020-3196High
A vulnerability in the SSL/TLS handler of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to exhaust memory resources on the affected device, leading to a DoS condition. The issue is due to improper resource management for inbound SSL/TLS connections. An attacker could exploit this by establishing multiple SSL/TLS connections with specific conditions, potentially exhausting memory and causing the device to stop accepting new SSL/TLS connections. Manual intervention is required to recover.
- CVE-2019-1694High
A vulnerability in the TCP processing engine of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a DoS condition. The issue is due to improper handling of TCP traffic. An attacker could exploit this by sending a specific sequence of packets at a high rate, potentially causing temporary traffic disruption during reboot.
- CVE-2019-1687High
A vulnerability in the TCP proxy functionality for Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause the device to restart unexpectedly, resulting in a DoS condition. The issue is due to an error in TCP-based packet inspection, which can cause an invalid Layer 2 header. An attacker could exploit this by sending a crafted TCP packet sequence.
- CVE-2018-15383High
A vulnerability in the cryptographic hardware accelerator driver of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary DoS condition. The issue exists because the devices have limited DMA memory and the software improperly handles resources in low-memory conditions. An attacker could exploit this by sending sustained high-rate malicious traffic, potentially exhausting DMA memory and causing a reload.
- CVE-2018-0228High
A vulnerability in the ingress flow creation functionality of Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause CPU utilization to increase upwards of 100%, leading to a denial of service (DoS) condition. The issue is due to incorrect handling of an internal software lock that can prevent other system processes from getting CPU cycles. An attacker could exploit this by sending a steady stream of malicious IP packets, potentially exhausting CPU resources and causing traffic delays.
Original NVD description (English source)
A vulnerability in the TCP packet processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a memory exhaustion condition. An attacker could exploit this vulnerability by sending a high rate of crafted TCP traffic through an affected device. A successful exploit could allow the attacker to exhaust device resources, resulting in a DoS condition for traffic transiting the affected device.