CVE-2020-3304 Denial of service in Cisco Adaptive Security Appliance (ASA) Software
Unauthenticated remote attackers can cause Cisco ASA and FTD devices to reload unexpectedly via crafted HTTP requests, resulting in a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3304?
CVE-2020-3304 is a high-severity denial of service vulnerability in Cisco Adaptive Security Appliance, published on 21 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition. Note: This vulnerability applies to IP Version 4 (IPv4) and IP Version 6 (IPv6) HTTP traffic.
Which versions are affected by CVE-2020-3304?
It affects 3 products.
Products include Cisco Adaptive Security Appliance, Cisco Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense.
How do I fix CVE-2020-3304?
No fix has been published for CVE-2020-3304 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-3304 being exploited?
There is no known exploitation of CVE-2020-3304 in the wild and no public exploit code.
Other vulnerabilities in Cisco Adaptive Security Appliance
- CVE-2021-1573 Denial of service in Cisco Adaptive Security Appliance Software
- CVE-2021-34793 Denial of service in Cisco Adaptive Security Appliance (ASA) Software
- CVE-2021-40117 Denial of service in Cisco Adaptive Security Appliance (ASA) Software
- CVE-2021-40118 Denial of service in Cisco Adaptive Security Appliance (ASA) Software
- CVE-2020-3436 File upload in Cisco Adaptive Security Appliance (ASA) Software
Sources
Also known as GHSA-43vw-qf47-8935.