8.6

CVE-2020-3562

A vulnerability in the SSL/TLS inspection of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series firewalls could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation for certain fields of specific SSL/TLS messages. An attacker could exploit this vulnerability by sending a malformed SSL/TLS message through an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. No manual intervention is needed to recover the device after it has reloaded.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Firepower Threat Defense Version6.3.0
   Cisco ≫ Firepower 2110 Version-
   Cisco ≫ Firepower 2120 Version-
   Cisco ≫ Firepower 2130 Version-
   Cisco ≫ Firepower 2140 Version-
Cisco ≫ Firepower Threat Defense Version6.4.0
   Cisco ≫ Firepower 2110 Version-
   Cisco ≫ Firepower 2120 Version-
   Cisco ≫ Firepower 2130 Version-
   Cisco ≫ Firepower 2140 Version-
Cisco ≫ Firepower Threat Defense Version6.5.0
   Cisco ≫ Firepower 2110 Version-
   Cisco ≫ Firepower 2120 Version-
   Cisco ≫ Firepower 2130 Version-
   Cisco ≫ Firepower 2140 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.53% 0.645
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.6 3.9 4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvd@nist.gov 7.1 8.6 6.9
AV:N/AC:M/Au:N/C:N/I:N/A:C
psirt@cisco.com 8.6 3.9 4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.