PT-2020-4457 · Cisco · Cisco Ftd

Published 2020-10-21 · Updated 2020-10-23 · CVE-2020-3565

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description A vulnerability in the TCP Intercept functionality could allow an unauthenticated, remote attacker to bypass configured Access Control Policies and Service Polices on an affected system. The issue exists because TCP Intercept is invoked when the embryonic connection limit is reached, causing the underlying detection engine to process packets incorrectly. An attacker could exploit this by sending a crafted stream of traffic that matches a policy on which TCP Intercept is configured, potentially allowing traffic to be forwarded when it should be dropped or incorrectly dropped.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Improper Access Control

Weakness Enumeration

CWE-287

CWE-284

Related Identifiers

BDU:2020-05005

CVE-2020-3565

Affected Products

Cisco Ftd

References · 5

• https://osv.dev/vulnerability/CVE-2020-3565 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05005 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tcp-intercept-bypass-xG9M3PbY · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3565 · Security Note
• https://t.me/cibsecurity/15503 · Telegram Post