SECUFOCUSNOW
Home›CVE index›CVE-2020-3283
ReviewHigh

CVE-2020-3283

Cisco Cisco Firepower Threat Defense Software, secure firewall threat defense, firepower 1010

A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco Firepower Threat Defense (FTD) Software when running on the Cisco Firepower 1000 Series platform could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to a communication error between internal functions. An attacker could exploit this vulnerability by sending a crafted SSL/TLS message to an affected device. A successful exploit could allow the attacker to cause a buffer underrun, which leads to a crash. The...

CVSS
8.6
EPSS
1.96%
78.9% percentile
CISA KEV
Not listed
Published
2020.05.07
PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability1.96%
Technical severityCVSS 8.6

Vulnerability overview

A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco Firepower Threat Defense (FTD) Software when running on the Cisco Firepower 1000 Series platform could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to a communication error between internal functions. An attacker could exploit this vulnerability by sending a crafted SSL/TLS message to an affected device. A successful exploit could allow the attacker to cause a buffer underrun, which leads to a crash. The...

Affected product and versions

Product
Cisco Cisco Firepower Threat Defense Software, secure firewall threat defense, firepower 1010
Affected versions
>= 6.4.0 < 6.4.0.9, 9.12(2.12), 9.13(0.33)
Fixed versions
6.4.0.9

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Cisco Cisco Firepower Threat Defense Software, secure firewall threat defense, firepower 1010 and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CWE
CWE-119, CWE-787