CVE-2022-20746CWE-476

CVE-2022-20746

High · published May 3, 2022

CVSS v3.1
8.6
EPSS
1%
Percentile
71.4
In the wild
Unconfirmed
What it is

A vulnerability in the TCP proxy functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper handling of TCP flows. An attacker could exploit this vulnerability by sending a crafted stream of TCP traffic through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01358 · 71.4th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2022-05-03T08:15Z
Affected products (4)
ProductVersionsFixed in
cisco/secure_firewall_threat_defense< 6.4.0.156.4.0.15
cisco/secure_firewall_threat_defense≥ 6.5.0, < 6.6.5.26.6.5.2
cisco/secure_firewall_threat_defense≥ 7.0.0, < 7.0.27.0.2
cisco/secure_firewall_threat_defenseall versions—
References (2)
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-tcp-dos-kM9SHhOu · [email protected]https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-tcp-dos-kM9SHhOu · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 MAY 03:15Z
    Cisco Firepower Threat Defense Software TCP Proxy Denial of Service Vulnerability
    cvelistv5