CVE-2024-20339
HighCVSS 8.6Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
A vulnerability in the TLS processing feature of Cisco Firepower Threat Defense (FTD) Software for Firepower 2100 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue occurs when processing TLS traffic, and exploitation by sending certain TLS traffic over IPv4 could cause the device to reload, impacting traffic through the device.
Risk Assessment
An attack could cause device downtime, affecting network service availability and traffic passing through the firewall.
Recommendation
Apply updates provided by Cisco for FTD software that address this vulnerability. Monitor Cisco security advisories for patches.
Other vulnerabilities in Cisco Firepower Threat Defense (FTD) Software
See all- CVE-2024-20407Medium
A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies. The issue is due to a logic error when handling embryonic (half-open) TCP connections. Devices configured with Snort 2 are not affected.
- CVE-2024-20330High
A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause memory corruption, leading to unexpected Snort detection engine restarts. The issue is due to improper memory management when processing specific TCP or UDP packets. Exploitation can cause repeated restarts, resulting in a DoS condition.
- CVE-2024-20261Medium
A vulnerability in the file policy feature used to inspect encrypted archive files of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured file policy to block an encrypted archive file. The issue is due to a logic error when a specific class of encrypted archive files is inspected.
- CVE-2023-20083High
A vulnerability in ICMPv6 inspection when configured with the Snort 2 detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause CPU usage to spike to 100%, stopping all traffic processing and resulting in a DoS condition. The issue is due to improper error checking when parsing ICMPv6 header fields. Sending a crafted ICMPv6 packet can exhaust CPU resources and stop traffic processing.
- CVE-2022-20950Medium
A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This is due to a lack of error-checking when SIP bidirectional flows are inspected by Snort 3. An attacker could exploit this by sending crafted SIP traffic, leading to a denial of service (DoS) condition.
- CVE-2022-20949Medium
A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system. This is due to improper restriction of access to HTTPS endpoints. An attacker could exploit this by sending specific messages to the HTTPS handler, allowing configuration changes that should only be performed through Firepower Management Center (FMC).
- CVE-2022-20767High
A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. It is due to improper handling of the DNS reputation enforcement rule. An attacker could exploit this by sending crafted UDP packets through the device to force a buildup of UDP connections. This only affects FTD devices running Snort 3.
- CVE-2022-20751High
A vulnerability in the Snort detection engine integration for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause unlimited memory consumption, leading to DoS. It is due to insufficient memory management for certain Snort events. An attacker can send crafted IP packets to generate specific Snort events, causing out-of-memory and traffic interruption; in some cases, device reload may occur.
- CVE-2021-34781High
A vulnerability in SSH connection processing for multi-instance deployments of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a DoS condition. It is due to improper error handling when an SSH session fails. An attacker can send a high rate of crafted SSH connections, leading to resource exhaustion and DoS; manual reload is required.
- CVE-2020-3533High
A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to restart unexpectedly. It is due to a lack of sufficient memory management protections under heavy SNMP polling loads. An attacker could exploit this by sending a high rate of SNMP requests to the SNMP daemon through the management interface.
Original NVD description (English source)
A vulnerability in the TLS processing feature of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an issue that occurs when TLS traffic is processed. An attacker could exploit this vulnerability by sending certain TLS traffic over IPv4 through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition and impacting traffic to and through the affected device.