CVE-2024-20412

A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, FirePOWER Services Software for ASA, and Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The issue is due to improper reassembly of traffic streams. An attacker could exploit this by sending crafted streams through an affected device, potentially delivering malicious requests to protected systems.

A vulnerability in the TLS 1.3 implementation of Cisco FTD Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This is due to a logic error in memory allocation handling during a TLS 1.3 session. An attacker could send a crafted TLS 1.3 message sequence to cause a reload, resulting in a DoS condition.

A vulnerability in the inter-device communication mechanisms between Cisco Firepower Threat Defense (FTD) Software and Cisco Firepower Management (FMC) Software could allow an authenticated, local attacker to execute arbitrary commands with root permissions on the underlying operating system of an affected device. This is due to insufficient validation of user-supplied input. An attacker could exploit this by accessing the expert mode and submitting specific commands, potentially executing code in the context of FMC or FTD.

A vulnerability in the SSL file policy implementation of Cisco FTD Software during SSL/TLS inspection with a URL Category could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart. This is due to a logic error when inspecting SSL/TLS connections with URL Category configured. An attacker could send a crafted SSL/TLS connection to trigger a reload, resulting in bypass or DoS.

A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device running in multi-instance mode. This is due to insufficient validation of user-supplied command arguments. An attacker could exploit this by submitting crafted input, leading to root command execution.

A vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a device reload, causing a denial of service (DoS). The issue is due to insufficient validation of SSL/TLS messages during software-based decryption. Exploitation involves sending a crafted SSL/TLS message through the device.

A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker to overwrite files on the file system using directory traversal techniques. This is due to insufficient validation of user input for the file path in a specific CLI command. A successful exploit could cause system instability if important system files are overwritten.

A vulnerability in the ingress packet processing path of Cisco FTD Software for interfaces configured as Inline Pair or in Passive mode could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS). The issue is due to insufficient validation when processing Ethernet frames. An attacker could exploit this by sending malicious Ethernet frames. Consequences may include filling the /ngfw partition, preventing login and boot, or causing a process crash leading to reload.

A vulnerability in the ICMP ingress packet processing of Cisco Firepower Threat Defense (FTD) Software for Firepower 4110 appliances could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to incomplete input validation upon receiving ICMP packets. Exploitation involves sending a high number of crafted ICMP or ICMPv6 packets.

A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to inefficient memory management. Exploitation involves sending a large number of TCP packets to a specific port.