NexaPulse
Subscribe
7.5highHigh

CVE-2020-3303

Cisco Adaptive Security Appliance

A vulnerability in the Internet Key Exchange version 1 (IKEv1) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper management of system memory. An attacker could exploit this vulnerability by sending malicious IKEv1 traffic to an affected device. A successful exploit could allow the attacker to cause a DoS condition on the affected device.

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is reachable over a network, without needing local access.
  • For an attacker who can reach it, no special conditions are needed to exploit it.
  • To exploit it, no account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
7.5 (v3.1)
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-399
Assigned by
psirt@cisco.com

Dates

Published
2020-05-06
Last modified
2026-08-11
Sources
NVD

Affected products

  • Cisco Adaptive Security Appliance- 9.6.4.36
  • Cisco Adaptive Security Appliance Software9.7 - 9.8.4.10, 9.9 - 9.10.1.30, 9.12 - 9.12.2.9
  • Cisco Asa 5505all versions
  • Cisco Asa 5510all versions
  • Cisco Asa 5512-Xall versions
  • Cisco Asa 5515-Xall versions
  • Cisco Asa 5520all versions
  • Cisco Asa 5525-Xall versions
  • Cisco Asa 5550all versions
  • Cisco Asa 5555-Xall versions
  • Cisco Asa 5580all versions
  • Cisco Asa 5585-Xall versions

As listed in the NVD configuration data. Not a statement about your estate.

References