Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2020-3254
CVE-2020-3254:
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation
Overview
Multiple vulnerabilities in the Media Gateway Control Protocol (MGCP) inspection feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software were discovered. These vulnerabilities, tracked as CVE-2020-3254, could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on affected devices (NVD, CVE).
Technical details
The vulnerabilities stem from inefficient memory management in the MGCP inspection feature. The issue has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) (NVD).
Impact
A successful exploitation of these vulnerabilities could allow an attacker to cause memory exhaustion, resulting in a restart of an affected device and causing a denial of service (DoS) condition for traffic traversing the device (NVD).
Mitigation and workarounds
Cisco has released software updates to address these vulnerabilities. The fixed versions vary depending on the product version: ASA Software versions 9.6.4.34, 9.8.4.7, 9.9.2.66, 9.10.1.27, and 9.12.2.1 contain fixes for these vulnerabilities (NVD).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management