CVE-2024-20353: Cisco Adaptive Security Appliance (ASA) Software

8.6

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Да

Атакува се

в каталога KEV от 24 април 2024

Атакува се в момента

zero-day

Време до експлоатация

в деня на публикуването или преди него

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

Експлоатация: активно се експлоатира
Атаката може да се автоматизира

Описание

Оригинално описание

A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.

Засегнати продукти

Cisco Cisco Adaptive Security Appliance (ASA) Software: 9.8.1; 9.8.1.5; 9.8.1.7; 9.8.2; 9.8.2.8; 9.8.2.14; 9.8.2.15; 9.8.2.17; 9.8.2.20; 9.8.2.24; 9.8.2.26; 9.8.2.28; 9.8.2.33; 9.8.2.35; 9.8.2.38; 9.8.3.8; 9.8.3.11; 9.8.3.14; 9.8.3.16; 9.8.3.18; 9.8.3.21; 9.8.3; 9.8.3.26; 9.8.3.29; 9.8.4; 9.8.4.3; 9.8.4.7; 9.8.4.8; 9.8.4.10; 9.8.4.12; 9.8.4.15; 9.8.4.17; 9.8.4.25; 9.8.4.20; 9.8.4.22; 9.8.4.26; 9.8.4.29; 9.8.4.32; 9.8.4.33; 9.8.4.34; 9.8.4.35; 9.8.4.39; 9.8.4.40; 9.8.4.41; 9.8.4.43; 9.8.4.44; 9.8.4.45; 9.8.4.46; 9.8.4.48; 9.12.1; 9.12.1.2; 9.12.1.3; 9.12.2; 9.12.2.4; 9.12.2.5; 9.12.2.9; 9.12.3; 9.12.3.2; 9.12.3.7; 9.12.4; 9.12.3.12; 9.12.3.9; 9.12.2.1; 9.12.4.2; 9.12.4.4; 9.12.4.7; 9.12.4.10; 9.12.4.13; 9.12.4.8; 9.12.4.18; 9.12.4.24; 9.12.4.26; 9.12.4.29; 9.12.4.30; 9.12.4.35; 9.12.4.37; 9.12.4.38; 9.12.4.39; 9.12.4.40; 9.12.4.41; 9.12.4.47; 9.12.4.48; 9.12.4.50; 9.12.4.52; 9.12.4.54; 9.12.4.55; 9.12.4.56; 9.12.4.58; 9.12.4.62; 9.12.4.65; 9.14.1; 9.14.1.10; 9.14.1.6; 9.14.1.15; 9.14.1.19; 9.14.1.30; 9.14.2; 9.14.2.4; 9.14.2.8; 9.14.2.13; 9.14.2.15; 9.14.3; 9.14.3.1; 9.14.3.9; 9.14.3.11; 9.14.3.13; 9.14.3.18; 9.14.3.15; 9.14.4; 9.14.4.6; 9.14.4.7; 9.14.4.12; 9.14.4.13; 9.14.4.14; 9.14.4.15; 9.14.4.17; 9.14.4.22; 9.14.4.23; 9.15.1; 9.15.1.7; 9.15.1.10; 9.15.1.15; 9.15.1.16; 9.15.1.17; 9.15.1.1; 9.15.1.21; 9.16.1; 9.16.1.28; 9.16.2; 9.16.2.3; 9.16.2.7; 9.16.2.11; 9.16.2.13; 9.16.2.14; 9.16.3; 9.16.3.3; 9.16.3.14; 9.16.3.15; 9.16.3.19; 9.16.3.23; 9.16.4; 9.16.4.9; 9.16.4.14; 9.16.4.18; 9.16.4.19; 9.16.4.27; 9.16.4.38; 9.16.4.39; 9.16.4.42; 9.16.4.48; 9.16.4.55; 9.17.1; 9.17.1.7; 9.17.1.9; 9.17.1.10; 9.17.1.11; 9.17.1.13; 9.17.1.15; 9.17.1.20; 9.17.1.30; 9.17.1.33; 9.18.1; 9.18.1.3; 9.18.2; 9.18.2.5; 9.18.2.7; 9.18.2.8; 9.18.3; 9.18.3.39; 9.18.3.46; 9.18.3.53; 9.18.3.55; 9.18.3.56; 9.18.4; 9.18.4.5; 9.18.4.8; 9.19.1; 9.19.1.5; 9.19.1.9; 9.19.1.12; 9.19.1.18; 9.19.1.22; 9.19.1.24; 9.19.1.27; 9.20.1; 9.20.1.5; 9.20.2
Cisco Cisco Firepower Threat Defense Software: 6.2.3; 6.2.3.1; 6.2.3.2; 6.2.3.3; 6.2.3.4; 6.2.3.5; 6.2.3.6; 6.2.3.7; 6.2.3.8; 6.2.3.10; 6.2.3.11; 6.2.3.9; 6.2.3.12; 6.2.3.13; 6.2.3.14; 6.2.3.15; 6.2.3.16; 6.2.3.17; 6.2.3.18; 6.6.0; 6.6.0.1; 6.6.1; 6.6.3; 6.6.4; 6.6.5; 6.6.5.1; 6.6.5.2; 6.6.7; 6.6.7.1; 6.4.0; 6.4.0.1; 6.4.0.3; 6.4.0.2; 6.4.0.4; 6.4.0.5; 6.4.0.6; 6.4.0.7; 6.4.0.8; 6.4.0.9; 6.4.0.10; 6.4.0.11; 6.4.0.12; 6.4.0.13; 6.4.0.14; 6.4.0.15; 6.4.0.16; 6.4.0.17; 6.7.0; 6.7.0.1; 6.7.0.2; 6.7.0.3; 7.0.0; 7.0.0.1; 7.0.1; 7.0.1.1; 7.0.2; 7.0.2.1; 7.0.3; 7.0.4; 7.0.5; 7.0.6; 7.0.6.1; 7.1.0; 7.1.0.1; 7.1.0.2; 7.1.0.3; 7.2.0; 7.2.0.1; 7.2.1; 7.2.2; 7.2.3; 7.2.4; 7.2.4.1; 7.2.5; 7.2.5.1; 7.3.0; 7.3.1; 7.3.1.1; 7.4.0; 7.4.1
cisco asa: 9.8.1 до 9.8.4.48
cisco firepower_threat_defense_software: 6.2.3 до 6.2.3.18

Вид слабост

CWE-835 Loop with Unreachable Exit Condition

История

24 април 2024 Публикувано

Статии във FO.bg

Cisco ASA и FTD устройствата под обсада - ArcaneDoor атака