CVE Vulnerability

CVE-2020-3254

Multiple vulnerabilities in the Media Gateway Control Protocol (MGCP) inspection feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerabilities are due to inefficient memory management. An attacker could exploit these vulnerabilities by sending crafted MGCP packets through an affected device. An exploit could allow the attacker to cause memory exhaustion resulting in a restart of an affected device, causing a DoS condition for traffic traversing the device.

7.8 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 6.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-mgcp-SUqB8VKH Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*
Information

Published : 2020-05-06 05:15

Updated : 2020-05-12 06:07

NVD link : CVE-2020-3254

Mitre link : CVE-2020-3254

Products Affected

Asa 5550 Firmware

Cisco

CWE
CWE-400