Uncontrolled resource consumption in Cisco Firepower Detection Engine
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-400.
Summary
A vulnerability in the detection engine reassembly of Secure Sockets Layer (SSL) packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition because the Snort process consumes a high level of CPU resources. Affected Products: This vulnerability affects Cisco Firepower System Software running software releases 6.0.0, 6.1.0, 6.2.0, or 6.2.1 when the device is configured with an SSL policy that has at least one rule specifying traffic decryption. More Information: CSCvc58563. Known Affected Releases: 6.0.0 6.1.0 6.2.0 6.2.1.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cisco Firepower Detection Engine | Cisco Firepower Detection Engine | — | No fix listed | CNA |
- Cisco Firepower Detection Engine Vendor— Affected Cisco Firepower Detection Engine Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:secure_firewall_management_center:6.0.0:*:*:*:*:*:*:* | 6.0.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_firewall_management_center:6.1.0:*:*:*:*:*:*:* | 6.1.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_firewall_management_center:6.2.0:*:*:*:*:*:*:* | 6.2.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_firewall_management_center:6.2.1:*:*:*:*:*:*:* | 6.2.1 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:secure_firewall_management_center:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_firewall_management_center:6.1.0:*:*:*:*:*:*:* Versions 6.1.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_firewall_management_center:6.2.0:*:*:*:*:*:*:* Versions 6.2.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_firewall_management_center:6.2.1:*:*:*:*:*:*:* Versions 6.2.1 Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-3885
- 2026-10-03 Alias added: GHSA-96h7-mg93-6889
References
More Cisco Secure Firewall Management Center vulnerabilities
- TI-2026-16344 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2026-16292 Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2026-16502 Cisco Secure Firewall Management Center Software Static Credential Vulnerability KEVCVSS 3.1MEDIUM 5.3
- TI-2016-05515 The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1… CVSS 3.1HIGH 8.8
- TI-2025-14563 Cisco Secure Firewall Management Center Software Radius Remote Code Execution Vulnerability CVSS 3.1CRITICAL 10.0
- TI-2023-06757 Improper privilege management in Cisco Firepower Management Center CVSS 3.1CRITICAL 9.9
Sources
- CVE-2017-3885 · CVE Program
- CVE-2017-3885 · NVD
- FIRST EPSS
- GHSA-96h7-mg93-6889 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences