CVE-2022-20757: cisco cisco firepower threat defense software

Vulnerability summary

CVE-2022-20757 is a high (CVSS 8.6) vulnerability in cisco cisco firepower threat defense software. EPSS estimates a 1.26% chance of exploitation in the next 30 days, higher than 69.1% of scored vulnerabilities.

Timeline

1. 03-05-2022
   PublishedVulnerability first disclosed.
2. 06-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the connection handling function in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper traffic handling when platform limits are reached. An attacker could exploit this vulnerability by sending a high rate of UDP traffic through an affected device. A successful exploit could allow the attacker to cause all new, incoming connections to be dropped, resulting in a DoS condition.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.