CVE-2023-20070
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A vulnerability in the TLS 1.3 implementation of Cisco FTD Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This is due to a logic error in memory allocation handling during a TLS 1.3 session. An attacker could send a crafted TLS 1.3 message sequence to cause a reload, resulting in a DoS condition.
Risk Assessment
Reloading the Snort 3 engine may cause inspection gaps, potentially leading to temporary loss of network protection and possible malicious traffic passage.
Recommendation
Apply Cisco updates for FTD. Monitor devices for unexpected Snort 3 restarts and consider restricting TLS 1.3 traffic if feasible.
Other vulnerabilities in Cisco Firepower Threat Defense Software
See all- CVE-2024-20412Critical
A vulnerability in Cisco Firepower Threat Defense (FTD) Software for Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthenticated, local attacker to access an affected system using static credentials. The issue is due to the presence of static accounts with hard-coded passwords.
- CVE-2019-1978Medium
A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, FirePOWER Services Software for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The issue is due to improper reassembly of traffic streams. An attacker could exploit this by sending crafted streams through an affected device, potentially delivering malicious requests to protected systems.
- CVE-2023-20063High
A vulnerability in the inter-device communication mechanisms between Cisco Firepower Threat Defense (FTD) Software and Cisco Firepower Management (FMC) Software could allow an authenticated, local attacker to execute arbitrary commands with root permissions on the underlying operating system of an affected device. This is due to insufficient validation of user-supplied input. An attacker could exploit this by accessing the expert mode and submitting specific commands, potentially executing code in the context of FMC or FTD.
- CVE-2023-20177Medium
A vulnerability in the SSL file policy implementation of Cisco FTD Software during SSL/TLS inspection with a URL Category could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This is due to a logic error when inspecting SSL/TLS connections with URL Category configured. An attacker could send a crafted SSL/TLS connection to trigger a reload, resulting in bypass or DoS.
- CVE-2021-1448High
A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device running in multi-instance mode. This is due to insufficient validation of user-supplied command arguments. An attacker could exploit this by submitting crafted input, leading to root command execution.
- CVE-2021-1402High
A vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a device reload, causing a denial of service (DoS). The issue is due to insufficient validation of SSL/TLS messages during software-based decryption. Exploitation involves sending a crafted SSL/TLS message through the device.
- CVE-2021-1256Medium
A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker to overwrite files on the file system using directory traversal techniques. This is due to insufficient validation of user input for the file path in a specific CLI command. A successful exploit could cause system instability if important system files are overwritten.
- CVE-2020-3577High
A vulnerability in the ingress packet processing path of Cisco FTD Software for interfaces configured as Inline Pair or in Passive mode could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS). The issue is due to insufficient validation when processing Ethernet frames. An attacker could exploit this by sending malicious Ethernet frames. Consequences may include filling the /ngfw partition, preventing login and boot, or causing a process crash leading to reload.
- CVE-2020-3571High
A vulnerability in the ICMP ingress packet processing of Cisco Firepower Threat Defense (FTD) Software for Firepower 4110 appliances could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to incomplete input validation upon receiving ICMP packets. Exploitation involves sending a high number of crafted ICMP or ICMPv6 packets.
- CVE-2020-3563High
A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to inefficient memory management. Exploitation involves sending a large number of TCP packets to a specific port.
Original NVD description (English source)
A vulnerability in the TLS 1.3 implementation of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This vulnerability is due to a logic error in how memory allocations are handled during a TLS 1.3 session. Under specific, time-based constraints, an attacker could exploit this vulnerability by sending a crafted TLS 1.3 message sequence through an affected device. A successful exploit could allow the attacker to cause the Snort 3 detection engine to reload, resulting in a denial of service (DoS) condition. While the Snort detection engine reloads, packets going through the FTD device that are sent to the Snort detection engine will be dropped. The Snort detection engine will restart automatically. No manual intervention is required.