Cisco Adaptive Security Appliance Software SSL/TLS Denial of Service Vulnerability (Cisco Cisco Adaptive Security Appliance (ASA) Software)

CVE-2020-27124
HIGH 8.6

En bref

Source
NVD
EPSS
EPSS 0.92 % · centile 60 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
cisco
Statut NVD
Analyzed

Description

A vulnerability in the SSL/TLS handler of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause the affected device to reload unexpectedly, leading to a denial of service (DoS) condition. The vulnerability is due to improper error handling on established SSL/TLS connections. An attacker could exploit this vulnerability by establishing an SSL/TLS connection with the affected device and then sending a malicious SSL/TLS message within that connection. A successful exploit could allow the attacker to cause the device to reload.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Faiblesses (CWE)

  • CWE-457 — Use of Uninitialized Variable

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/RL:X/RC:X/E:Xcisco
CVSS 3.1HIGH 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HNVD · psirt@cisco.com (Secondary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Cisco · Cisco Adaptive Security Appliance (ASA) Softwareaffected N/A

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD