CVE-2020-3533: 
Cisco Firepower Threat Defense (FTD) vulnerability analysis and mitigation

A vulnerability (CVE-2020-3533) was discovered in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Firepower Threat Defense (FTD) Software. This vulnerability affects all versions of SNMP and was disclosed in October 2020 (Cisco Advisory).

The vulnerability stems from a lack of sufficient memory management protections under heavy SNMP polling loads. It has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The weakness has been categorized as CWE-400 (Uncontrolled Resource Consumption) (NVD).

A successful exploitation of this vulnerability could allow an unauthenticated, remote attacker to cause the SNMP daemon process to consume a large amount of system memory over time, leading to an unexpected device restart and resulting in a denial of service (DoS) condition (Cisco Advisory).

An attacker could exploit this vulnerability by sending a high rate of SNMP requests to the SNMP daemon through the management interface on an affected device. The attack requires no authentication or user interaction, making it relatively straightforward to execute (NVD).

Cisco has released software updates that address this vulnerability. The affected versions include Firepower Threat Defense Software versions up to (excluding) 6.3.0.6, versions from 6.4.0 up to (excluding) 6.4.0.10, versions from 6.5.0 up to (excluding) 6.5.0.5, and versions from 6.6.0 up to (excluding) 6.6.1 (NVD).