PT-2020-2232 · Cisco · Cisco Firepower Device Manager On-Box

Published 2020-05-05 · Updated 2021-10-19 · CVE-2020-3310

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Firepower Device Manager On-Box software (affected versions not specified)

Description The issue is related to insufficient hardening of the XML parser configuration, which could allow an authenticated, remote attacker to cause the system to become unstable or reload. An attacker could exploit this by uploading a malicious XML file or sending a crafted XML file, potentially causing system instability, memory exhaustion, and in some cases leading to a reload of the system. The vulnerability is also described as a buffer overflow issue in the XML parser code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2020-02148

CVE-2020-3310

Affected Products

Cisco Firepower Device Manager On-Box

References · 5

• https://osv.dev/vulnerability/CVE-2020-3310 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xpftd-gYDXyN8H · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02148 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3310 · Security Note
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-3310 · Note