CVE-2022-20854
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
A vulnerability in the processing of SSH connections of Cisco Firepower Management Center (FMC) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). This is due to improper error handling when an SSH session fails. An attacker could exploit this by sending a high rate of crafted SSH connections, leading to resource exhaustion and reboot.
Risk Assessment
The risk is that a remote attacker can overload security devices, potentially causing service unavailability.
Recommendation
It is recommended to update FMC/FTD software to a patched version and limit the rate of SSH connections.
Other vulnerabilities in Cisco Firepower Management Center
See all- CVE-2016-6434High
Cisco Firepower Management Center version 6.0.1 has hardcoded database credentials, allowing local users to obtain sensitive information via CLI access.
- CVE-2016-6433High
The Threat Management Console in Cisco Firepower Management Center versions 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters.
- CVE-2016-6419High
CVE-2016-6419 is an SQL injection vulnerability in Cisco Firepower Management Center versions 4.10.3 through 5.4.0 that allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
- CVE-2021-34764Medium
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-site scripting (XSS) attack or an open redirect attack. For more details, see the Details section of the Cisco advisory.
- CVE-2021-34762High
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack. The attacker would require valid device credentials. The issue is due to insufficient input validation of the HTTPS URL.
- CVE-2020-3549High
A vulnerability in the sftunnel functionality of Cisco Firepower Management Center (FMC) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to obtain the device registration hash. This is due to insufficient sftunnel negotiation protection during initial device registration. An attacker in a man-in-the-middle position could intercept and modify sftunnel communication between FMC and FTD, potentially altering configuration or alert data.
Original NVD description (English source)
A vulnerability in the processing of SSH connections of Cisco Firepower Management Center (FMC) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when an SSH session fails to be established. An attacker could exploit this vulnerability by sending a high rate of crafted SSH connections to the instance. A successful exploit could allow the attacker to cause resource exhaustion, resulting in a reboot on the affected device.