CVE-2020-3555: cisco adaptive_security_appliance Improper Resource Shutdown or Release

Vulnerability summary

CVE-2020-3555 is a high (CVSS 7.8) Improper Resource Shutdown or Release vulnerability in cisco adaptive_security_appliance. EPSS estimates a 1.70% chance of exploitation in the next 30 days, higher than 76.7% of scored vulnerabilities.

Timeline

1. 21-10-2020
   PublishedVulnerability first disclosed.
2. 13-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the SIP inspection process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a crash and reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to a watchdog timeout and crash during the cleanup of threads that are associated with a SIP connection that is being deleted from the connection list. An attacker could exploit this vulnerability by sending a high rate of crafted SIP traffic through an affected device. A successful exploit could allow the attacker to cause a watchdog timeout and crash, resulting in a crash and reload of the affected device.

• CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.