CVE-2022-20927 — Classic Buffer Overflow in Cisco Firepower Threat Defense

CWE-120 — Classic Buffer OverflowCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources
Severity
6.5MEDIUMNVD
CNA7.7
EPSS
0.2%
top 58.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Cisco Firepower Threat DefenseCisco Adaptive Security Appliance SoftwareCisco Firepower Services Software FOR ASA+2 more
Timeline
PublishedNov 15
Latest updateNov 16

Description

A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management when a device initiates SSL/TLS connections. An attacker could exploit this vulnerability by ensuring that the device will connect to an SSL/TLS server that is using specific encryption para…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶NVDcisco/firepower_threat_defense6.5.0 — 6.5.0.5+8

🔴Vulnerability Details

2
GHSA
GHSA-4g76-357g-vr49: A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allo↗2022-11-16
▶
CVEList
CVE-2022-20927: A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allo↗2022-11-10
▶

📋Vendor Advisories

1
Cisco
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Client Denial of Service Vulnerability↗2022-11-09
▶
CVE-2022-20927 — Classic Buffer Overflow in Cisco | cvebase