Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affe...

CVE-2020-3304 · published 6 years ago
Summary

A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability...

What to do
  • Update cisco adaptive_security_appliance to version 9.6.4.45 or later.
Affected software
VendorProductAffected versions
cisco adaptive_security_appliance < 9.6.4.45
cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*
cisco secure_firewall_threat_defense < 6.3.0.6
>= 6.4.0, < 6.4.0.10
>= 6.5.0, < 6.5.0.5
>= 6.6.0, < 6.6.1
cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*
cisco adaptive_security_appliance_software >= 9.8.0, < 9.8.4.22
>= 9.9.0, < 9.9.2.80
>= 9.10.0, < 9.10.1.44
>= 9.12.0, < 9.12.3.12
>= 9.13.0, < 9.13.1.12
>= 9.14.0, < 9.14.1.10
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
Original advisory text
A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affe...
A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition. Note: This vulnerability applies to IP Version 4 (IPv4) and IP Version 6 (IPv6) HTTP traffic.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.6 High
Exploitation
4% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
CWE-20Improper Input Validation
Timeline
Published21 Oct 2020
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2020-3304 · NVD
Track software like this
Free during beta