CVE-2021-34783

CWE-119 — Buffer OverflowCWE-20 — Improper Input Validation4 documents4 sources
Severity
7.5HIGH
EPSS
0.8%
top 26.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
Cisco Adaptive Security Appliance SoftwareCisco Firepower Threat DefenseCisco Cisco Adaptive Security Appliance (asa) Software+8 more
Timeline
PublishedOct 27
Latest updateMay 24

Description

A vulnerability in the software-based SSL/TLS message handler of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient validation of SSL/TLS messages when the device performs software-based SSL/TLS decryption. An attacker could exploit this vulnerability by sending a crafted SSL/TL…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 3.9 | Impact: 4.0

Affected Packages11 packages

▶NVDcisco/firepower_threat_defense6.4.0 — 6.4.0.13+3
▶NVDcisco/asa_5505_firmware009.016\(001.025\), 009.016\(001\)+1
▶NVDcisco/asa_5580_firmware009.016\(001.025\), 009.016\(001\)+1

🔴Vulnerability Details

2
GHSA
GHSA-vwpf-cvqf-r3h9: A vulnerability in the software-based SSL/TLS message handler of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) S↗2022-05-24
▶
CVEList
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Software-Based SSL/TLS Denial of Service Vulnerability↗2021-10-27
▶

📋Vendor Advisories

1
Cisco
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Software-Based SSL/TLS Denial of Service Vulnerability↗2021-10-27
▶