CVE-2018-15454High· 8.6▾ Abyssal⚠ Exploited in the wild0dayA vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an …
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 47.3 · likelihood 0.9 · exploitation 25
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
4.4%
A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload or trigger high CPU, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of SIP traffic. An attacker could exploit this vulnerability by sending SIP requests designed to specifically trigger this issue at a high rate across an affected device. Software updates that address this vulnerability are not yet available.
adaptive_security_appliance_software >= 9.4, < 9.4.4.27adaptive_security_appliance_software >= 9.6, < 9.6.4.18adaptive_security_appliance_software >= 9.8, < 9.8.3.16adaptive_security_appliance_software >= 9.9, < 9.9.2.32adaptive_security_appliance_software >= 9.10, < 9.10.1.2secure_firewall_threat_defense >= 6.1.0, < 6.1.0.7secure_firewall_threat_defense >= 6.2.0, < 6.2.0.6secure_firewall_threat_defense >= 6.2.2, < 6.2.2.4secure_firewall_threat_defense >= 6.2.3, < 6.2.3.7Upgrade past the affected range:
adaptive_security_appliance_software 9.10.1.2secure_firewall_threat_defense 6.2.3.7Connected by shared product, vendor, weakness, or advisory.
CVE-2020-3577High· 7.4A vulnerability in the ingress packet processing path of Cisco Firepower Threat Defense (FTD) Software for interfaces that are configured either as Inline Pair or in Passive mode could allow an unauthenticated, adjacent attacker to cause…
CVE-2020-3317High· 7.5A vulnerability in the ssl_inspection component of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to crash Snort instances
CVE-2020-3191High· 8.6A vulnerability in DNS over IPv6 packet processing for Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to unexpectedly reloa…
CVE-2020-3166Medium· 6.7A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to read or write arbitrary files on the underlying operating system (OS)
CVE-2019-12694Medium· 6.7A vulnerability in the command line interface (CLI) of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker with administrative privileges to execute commands on the underlying operating system with …
CVE-2020-3452High· 7.5A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks an…