Vulnerability Details : CVE-2020-3254
Multiple vulnerabilities in the Media Gateway Control Protocol (MGCP) inspection feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerabilities are due to inefficient memory management. An attacker could exploit these vulnerabilities by sending crafted MGCP packets through an affected device. An exploit could allow the attacker to cause memory exhaustion resulting in a restart of an affected device, causing a DoS condition for traffic traversing the device.
Vulnerability category: Denial of service
Products affected by CVE-2020-3254
- Cisco » Adaptive Security Appliance SoftwareVersions from including (>=) 9.8 and before (<) 9.8.4.7cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
- Cisco » Adaptive Security Appliance SoftwareVersions from including (>=) 9.10 and before (<) 9.10.1.27cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
- Cisco » Adaptive Security Appliance SoftwareVersions from including (>=) 9.6 and before (<) 9.6.4.34cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
- Cisco » Adaptive Security Appliance SoftwareVersions from including (>=) 9.12 and before (<) 9.12.2.1cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
- Cisco » Adaptive Security Appliance SoftwareVersions from including (>=) 9.9 and before (<) 9.9.2.66cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:asa_5505_firmware:9.10\(1.3\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:asa_5510_firmware:9.10\(1.3\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:asa_5512-x_firmware:9.10\(1.3\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:asa_5515-x_firmware:9.10\(1.3\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:asa_5520_firmware:9.10\(1.3\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:asa_5525-x_firmware:9.10\(1.3\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:asa_5540_firmware:9.10\(1.3\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:asa_5545-x_firmware:9.10\(1.3\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:asa_5550_firmware:9.10\(1.3\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:asa_5555-x_firmware:9.10\(1.3\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:asa_5580_firmware:9.10\(1.3\):*:*:*:*:*:*:*
- cpe:2.3:o:cisco:asa_5585-x_firmware:9.10\(1.3\):*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-3254
0.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 52 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-3254
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |
10.0
|
6.9
|
NIST | |
|
8.6
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
3.9
|
4.0
|
Cisco Systems, Inc. | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2020-3254
-
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)
References for CVE-2020-3254
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-mgcp-SUqB8VKH
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Media Gateway Control Protocol Denial of Service VulnerabilitiesVendor Advisory
Jump to