Cisco Firepower Threat Defense vulnerabilities

A vulnerability in payload inspection for Ethernet Industrial Protocol (ENIP) traffic in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. This is due to incomplete processing during deep packet inspection. An attacker could exploit this by sending a crafted ENIP packet, potentially bypassing access control and intrusion policies.

A vulnerability in the TCP/IP traffic handling function of the Snort Detection Engine of Cisco Firepower Threat Defense (FTD) Software and Cisco FirePOWER Services could allow an unauthenticated, remote attacker to cause legitimate network traffic to be dropped, resulting in a denial of service (DoS). This is due to improper handling of TCP/IP traffic. An attacker could exploit this by sending a large amount of TCP/IP traffic, causing traffic drops and requiring a reboot.

A vulnerability in the interaction between the SMB protocol preprocessor and the Snort 3 detection engine in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies or cause a denial of service (DoS) condition. The issue is due to improper error-checking when processing SMB traffic. An attacker could exploit this by sending a crafted SMB packet stream, potentially causing the Snort process to reload and resulting in DoS.

A vulnerability in the internal packet processing of Cisco Firepower Threat Defense (FTD) Software for Firepower 2100 Series Firewalls could allow an unauthenticated, remote attacker to cause a denial of service (DoS). This is due to improper handling of certain packets sent to the inspection engine. An attacker could exploit this by sending a series of crafted packets, depleting all 9,472 byte blocks and causing traffic loss or unexpected reload.

A vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). This is due to a memory handling error when GRE traffic is processed. An attacker could exploit this by sending a crafted GRE payload, causing a device restart.

A vulnerability in the TLS handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain access to sensitive information. This is due to improper implementation of countermeasures against a Bleichenbacher attack on devices using SSL decryption policies. An attacker could exploit this by sending crafted TLS messages, potentially allowing decryption of previously captured TLS sessions.

A vulnerability in the connection handling function in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This is due to improper traffic handling when platform limits are reached. An attacker could exploit this by sending a high rate of UDP traffic, causing all new incoming connections to be dropped.

A vulnerability in the local malware analysis process of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to insufficient error handling. An attacker could send a crafted file through the device, causing the analysis process to crash and resulting in DoS. Manual intervention may be required.

A vulnerability in the TCP proxy functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This is due to improper handling of TCP flows. An attacker could exploit this by sending a crafted stream of TCP traffic, causing the device to reload.

A vulnerability in the Security Intelligence feed feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the Security Intelligence DNS feed. This is due to incorrect feed update processing. An attacker could send traffic through an affected device that should be blocked, to bypass device controls and send traffic to protected systems.

A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject XML into the command parser. This is due to insufficient input validation. Successful exploitation could result in unexpected processing of commands and unexpected output.

A vulnerability in Cisco Firepower Threat Defense (FTD) Software allows an authenticated local attacker with administrative privileges to overwrite or append arbitrary data to system files with root privileges. This is due to incomplete validation of user input for a specific CLI command.

Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information, see the Details section of the advisory.

Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information, see the Details section of the advisory.

Multiple vulnerabilities in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. This is due to incomplete processing during deep packet inspection for ENIP packets. An attacker could send a crafted ENIP packet to bypass access control and intrusion policies.

A vulnerability in the TCP Intercept functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured Access Control Policies (including Geolocation) and Service Policies. This is because TCP Intercept is invoked when the embryonic connection limit is reached, causing the detection engine to process packets incorrectly. An attacker could send a crafted traffic stream to match an incorrect policy, potentially forwarding traffic that should be dropped or vice versa.

A vulnerability in the SSL/TLS inspection of Cisco Firepower Threat Defense (FTD) Software for Firepower 2100 Series firewalls could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to improper input validation for certain fields of SSL/TLS messages.

A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access hidden commands. This is due to undocumented configuration commands. Successful exploitation could allow configuration changes to sections that should not be exposed to CLI access.

A vulnerability in the ssl_inspection component of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to crash Snort instances. This is due to insufficient input validation in the ssl_inspection component. An attacker could exploit this by sending a malformed TLS packet through a Cisco Adaptive Security Appliance (ASA), leading to a denial of service (DoS) condition.

A vulnerability in the Image Signature Verification feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with administrator-level credentials to install a malicious software patch. This is due to improper verification of digital signatures for patch images. An attacker could exploit this by crafting an unsigned patch to bypass signature checks, potentially booting a malicious patch image.

A vulnerability in the SSL/TLS handler of Cisco Firepower Threat Defense (FTD) Software on Firepower 1000 Series could allow an unauthenticated, remote attacker to trigger a DoS condition. The issue is due to a communication error between internal functions. An attacker could send a crafted SSL/TLS message, causing a buffer underrun and device crash, leading to reload.

A vulnerability in the management access list configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured management interface access list. The issue is due to inconsistent configuration of access lists. An attacker could send crafted remote management traffic to the local IP address, bypassing the policies.

A vulnerability in the GRE tunnel decapsulation feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a DoS condition. The issue is due to a memory handling error when GRE over IPv6 traffic is processed. An attacker could send crafted GRE over IPv6 packets with IPv4 or IPv6 payload, causing device crash.

A vulnerability in the application policy configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data. This is due to insufficient application identification. An attacker could exploit this by sending crafted traffic, potentially gaining unauthorized read access.

A vulnerability in the data acquisition (DAQ) component of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access control policies or cause a denial of service (DoS) condition. This is due to improper management of system memory during traffic inspection. An attacker could exploit this by generating specific traffic patterns, potentially exhausting memory and causing fail-open or fail-closed behavior.

A vulnerability in the detection engine of Cisco Firepower Threat Defense software could allow an unauthenticated, remote attacker to bypass a configured SSL Access Control (AC) policy to block SSL traffic. The issue is due to incorrect handling of TCP SSL packets received out of order. An attacker could send a crafted SSL connection through the device, bypassing the AC policy.

A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for Firepower 2100 Series could allow an unauthenticated, remote attacker to cause the device to stop processing traffic, resulting in a denial of service (DoS) condition. The issue is due to improper validation of IPv4 and IPv6 packets after reassembly.