CVE-2020-3565: cisco cisco firepower threat defense software Improper Access Control

Vulnerability summary

CVE-2020-3565 is a medium (CVSS 5.8) Improper Access Control vulnerability in cisco cisco firepower threat defense software. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 60.4% of scored vulnerabilities.

Timeline

1. 21-10-2020
   PublishedVulnerability first disclosed.
2. 13-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the TCP Intercept functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured Access Control Policies (including Geolocation) and Service Polices on an affected system. The vulnerability exists because TCP Intercept is invoked when the embryonic connection limit is reached, which can cause the underlying detection engine to process the packet incorrectly. An attacker could exploit this vulnerability by sending a crafted stream of traffic that matches a policy on which TCP Intercept is configured. A successful exploit could allow the attacker to match on an incorrect policy, which could allow the traffic to be forwarded when it should be dropped. In addition, the traffic could incorrectly be dropped.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.