CVE-2020-3186

CWE-284 — Improper Access Control4 documents4 sources
Severity
5.3MEDIUM
EPSS
0.2%
top 59.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
14
Cisco Firepower Threat DefenseCisco Cisco Firepower Threat Defense SoftwareCisco ASA 5505 Firmware+11 more
Timeline
PublishedMay 6
Latest updateMay 24

Description

A vulnerability in the management access list configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured management interface access list on an affected system. The vulnerability is due to the configuration of different management access lists, with ports allowed in one access list and denied in another. An attacker could exploit this vulnerability by sending crafted remote management traffic to the local IP address of an…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages14 packages

▶NVDcisco/firepower_threat_defense6.3.0 — 6.3.0.6+2
▶NVDcisco/asa_5505_firmware201.5\(23.16\), 9.12\(1.6\)+1
▶NVDcisco/asa_5510_firmware201.5\(23.16\), 9.12\(1.6\)+1
▶NVDcisco/asa_5520_firmware201.5\(23.16\), 9.12\(1.6\)+1

🔴Vulnerability Details

2
GHSA
GHSA-h2j6-v888-8gxm: A vulnerability in the management access list configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote at↗2022-05-24
▶
CVEList
Cisco Firepower Threat Defense Software Management Access List Bypass Vulnerability↗2020-05-06
▶

📋Vendor Advisories

1
Cisco
Cisco Firepower Threat Defense Software Management Access List Bypass Vulnerability↗2020-05-06
▶
CVE-2020-3186 (MEDIUM CVSS 5.3) | A vulnerability in the management a | cvebase.io