CVE-2020-3254: cisco adaptive_security_appliance_software Uncontrolled Resource Consumption
Vulnerability summary
CVE-2020-3254 is a high (CVSS 8.6) Uncontrolled Resource Consumption vulnerability in cisco adaptive_security_appliance_software. EPSS estimates a 1.98% chance of exploitation in the next 30 days, higher than 80.2% of scored vulnerabilities.
Timeline
- 06-05-2020PublishedVulnerability first disclosed.
- 15-11-2024Last modifiedVulnerability information updated.
Description
Multiple vulnerabilities in the Media Gateway Control Protocol (MGCP) inspection feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerabilities are due to inefficient memory management. An attacker could exploit these vulnerabilities by sending crafted MGCP packets through an affected device. An exploit could allow the attacker to cause memory exhaustion resulting in a restart of an affected device, causing a DoS condition for traffic traversing the device.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST8.6HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS trend
Probability
1.98%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
+0.07 pp
From 1.92% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco15 products
- adaptive_security_appliance_software≥ 9.6, < 9.6.4.34 | ≥ 9.8, < 9.8.4.7 | ≥ 9.9, < 9.9.2.66 | ≥ 9.10, < 9.10.1.27 | ≥ 9.12, < 9.12.2.1
- asa_5505_firmware9.10\(1.3\)
- asa_5510_firmware9.10\(1.3\)
- asa_5512-x_firmware9.10\(1.3\)
- asa_5515-x_firmware9.10\(1.3\)
1 vendor · 15 products
References
1 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-mgcp-SUqB8VKHVendor AdvisoryX Refsource CISCO