CVE-2021-1422
HighCVSS 7.7Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
A vulnerability in the software cryptography module of Cisco ASA and FTD Software could allow an authenticated, remote attacker or an unauthenticated attacker in a man-in-the-middle position to cause an unexpected reload of the device, resulting in a denial of service (DoS) condition. This is due to a logic error in handling specific decryption errors. An attacker could exploit this by sending malicious packets over an established IPsec connection, causing a crash and reload. Important: Successful exploitation would not compromise encrypted data. This affects only ASA 9.16.1 and FTD 7.0.0.
Risk Assessment
The risk is that an attacker could disrupt the ASA/FTD device, potentially impacting IPsec traffic and service availability, but without data compromise.
Recommendation
Apply the vendor-provided software update to non-affected versions and monitor IPsec connections.
Other vulnerabilities in Cisco Adaptive Security Appliance
See all- CVE-2024-20485Medium
A vulnerability in the VPN web server of Cisco ASA and FTD Software allows an authenticated local attacker with administrator privileges to execute arbitrary code with root privileges. This is due to improper validation of a specific file when read from system flash memory.
- CVE-2023-20006High
A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software for Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause an unexpected reload, resulting in a denial of service (DoS). This is due to an implementation error in cryptographic functions when offloaded to hardware. An attacker could exploit this by sending a crafted stream of SSL/TLS traffic.
- CVE-2023-20107High
A vulnerability in the deterministic random bit generator (DRBG) in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software for ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling discovery of the device's private key. This is due to insufficient entropy in the DRBG on these hardware platforms. An attacker could exploit this by generating many keys and looking for collisions with target devices.
- CVE-2022-20947High
A vulnerability in dynamic access policies (DAP) functionality of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a device reload, resulting in a denial of service (DoS). This is due to improper processing of HostScan data from the Posture module. An attacker could exploit this by sending crafted HostScan data.
- CVE-2022-20924High
A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS). This is due to insufficient input validation. An attacker could exploit this by sending a crafted SNMP request, causing a device reload.
- CVE-2022-20715High
A vulnerability in the remote access SSL VPN features of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This is due to improper validation of logged errors from client connections. An attacker could exploit this by sending crafted requests, causing the device to restart.
- CVE-2021-1493High
A vulnerability in the web services interface of Cisco ASA and FTD Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. This is due to insufficient boundary checks for specific data. An attacker could exploit this by sending a malicious HTTP request, potentially disclosing data fragments or causing a device reload and DoS.
- CVE-2020-3436High
A vulnerability in the web services interface of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to upload arbitrary-sized files to specific folders, leading to an unexpected device reload. The issue is due to inefficient handling of large file writes. An attacker could upload files to trigger a watchdog timeout, causing device reload and DoS.
- CVE-2020-3306High
A vulnerability in the DHCP module of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. This is due to incorrect processing of certain DHCP packets. An attacker could exploit this by sending a crafted DHCP packet, causing a DoS.
- CVE-2020-3305High
A vulnerability in the implementation of the Border Gateway Protocol (BGP) module in Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This is due to incorrect processing of certain BGP packets. An attacker could exploit this by sending a crafted BGP packet, causing a DoS.
Original NVD description (English source)
A vulnerability in the software cryptography module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker or an unauthenticated attacker in a man-in-the-middle position to cause an unexpected reload of the device that results in a denial of service (DoS) condition. The vulnerability is due to a logic error in how the software cryptography module handles specific types of decryption errors. An attacker could exploit this vulnerability by sending malicious packets over an established IPsec connection. A successful exploit could cause the device to crash, forcing it to reload. Important: Successful exploitation of this vulnerability would not cause a compromise of any encrypted data. Note: This vulnerability affects only Cisco ASA Software Release 9.16.1 and Cisco FTD Software Release 7.0.0.