CVE-2020-3304
Last modified
CVE-2020-3304 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. EPSS estimates a 3.86% chance of exploitation in the next 30 days.
Description
A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition. Note: This vulnerability applies to IP Version 4 (IPv4) and IP Version 6 (IPv6) HTTP traffic.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Adaptive Security Appliance | < 9.6.4.45 |
| Cisco | Secure Firewall Threat Defense | < 6.3.0.6 |
| Cisco | Secure Firewall Threat Defense | >= 6.4.0, < 6.4.0.10 |
| Cisco | Secure Firewall Threat Defense | >= 6.5.0, < 6.5.0.5 |
| Cisco | Secure Firewall Threat Defense | >= 6.6.0, < 6.6.1 |
| Cisco | Adaptive Security Appliance Software | >= 9.8.0, < 9.8.4.22 |
| Cisco | Adaptive Security Appliance Software | >= 9.9.0, < 9.9.2.80 |
| Cisco | Adaptive Security Appliance Software | >= 9.10.0, < 9.10.1.44 |
| Cisco | Adaptive Security Appliance Software | >= 9.12.0, < 9.12.3.12 |
| Cisco | Adaptive Security Appliance Software | >= 9.13.0, < 9.13.1.12 |
| Cisco | Adaptive Security Appliance Software | >= 9.14.0, < 9.14.1.10 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-3304?
How severe is CVE-2020-3304?
How do I fix CVE-2020-3304?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-3297A vulnerability in session management for the web-based inte…9.8
- CVE-2020-3298A vulnerability in the Open Shortest Path First (OSPF) imple…7.5
- CVE-2020-3299Multiple Cisco products are affected by a vulnerability in t…5.8
- CVE-2020-3301Multiple vulnerabilities in Cisco Firepower Management Cente…4.4
- CVE-2020-3302A vulnerability in the web UI of Cisco Firepower Management …8.1
- CVE-2020-3303A vulnerability in the Internet Key Exchange version 1 (IKEv…7.5
- CVE-2020-3305A vulnerability in the implementation of the Border Gateway …7.5
- CVE-2020-3306A vulnerability in the DHCP module of Cisco Adaptive Securit…7.5
- CVE-2020-3307A vulnerability in the web UI of Cisco Firepower Management …5.3
- CVE-2020-3308A vulnerability in the Image Signature Verification feature …4.9
- CVE-2020-3309A vulnerability in Cisco Firepower Device Manager (FDM) On-B…7.2
- CVE-2020-3310A vulnerability in the XML parser code of Cisco Firepower De…4.9
Are you affected by CVE-2020-3304?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST