Cisco Firepower 1000 Series SSL/TLS Denial of Service Vulnerability
Priority MEDIUM 47CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco Firepower Threat Defense (FTD) Software when running on the Cisco Firepower 1000 Series platform could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to a communication error between internal functions. An attacker could exploit this vulnerability by sending a crafted SSL/TLS message to an affected device. A successful exploit could allow the attacker to cause a buffer underrun, which leads to a crash. The crash causes the affected device to reload.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02021 81st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Firepower Threat Defense Software | all versions | — | No fix listed | CNA |
- Cisco Firepower Threat Defense Software VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 41
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:* | 6.4.0 to before 6.4.0.9 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:firepower_1010:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_1020:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_1030:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firepower_1040:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:asa_5505_firmware:9.12\(2.12\):*:*:*:*:*:*:* | 9.12(2.12) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asa_5505_firmware:9.13\(0.33\):*:*:*:*:*:*:* | 9.13(0.33) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:asa_5510_firmware:9.12\(2.12\):*:*:*:*:*:*:* | 9.12(2.12) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asa_5510_firmware:9.13\(0.33\):*:*:*:*:*:*:* | 9.13(0.33) | Vulnerable | Cisco |
- cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:* Versions 6.4.0 to before 6.4.0.9 Vulnerable ·Cisco
- cpe:2.3:h:cisco:firepower_1010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_1020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_1030:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firepower_1040:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:asa_5505_firmware:9.12\(2.12\):*:*:*:*:*:*:* Versions 9.12(2.12) Vulnerable ·Cisco
- cpe:2.3:o:cisco:asa_5505_firmware:9.13\(0.33\):*:*:*:*:*:*:* Versions 9.13(0.33) Vulnerable ·Cisco
- cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:asa_5510_firmware:9.12\(2.12\):*:*:*:*:*:*:* Versions 9.12(2.12) Vulnerable ·Cisco
- cpe:2.3:o:cisco:asa_5510_firmware:9.13\(0.33\):*:*:*:*:*:*:* Versions 9.13(0.33) Vulnerable ·Cisco
Show 31 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:cisco:asa_5510:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:asa_5512-x_firmware:9.12\(2.12\):*:*:*:*:*:*:* | 9.12(2.12) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asa_5512-x_firmware:9.13\(0.33\):*:*:*:*:*:*:* | 9.13(0.33) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:asa_5515-x_firmware:9.12\(2.12\):*:*:*:*:*:*:* | 9.12(2.12) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asa_5515-x_firmware:9.13\(0.33\):*:*:*:*:*:*:* | 9.13(0.33) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:asa_5520_firmware:9.12\(2.12\):*:*:*:*:*:*:* | 9.12(2.12) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asa_5520_firmware:9.13\(0.33\):*:*:*:*:*:*:* | 9.13(0.33) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asa_5520:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:asa_5525-x_firmware:9.12\(2.12\):*:*:*:*:*:*:* | 9.12(2.12) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asa_5525-x_firmware:9.13\(0.33\):*:*:*:*:*:*:* | 9.13(0.33) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:asa_5540_firmware:9.12\(2.12\):*:*:*:*:*:*:* | 9.12(2.12) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asa_5540_firmware:9.13\(0.33\):*:*:*:*:*:*:* | 9.13(0.33) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asa_5540:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:asa_5545-x_firmware:9.12\(2.12\):*:*:*:*:*:*:* | 9.12(2.12) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asa_5545-x_firmware:9.13\(0.33\):*:*:*:*:*:*:* | 9.13(0.33) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:asa_5550_firmware:9.12\(2.12\):*:*:*:*:*:*:* | 9.12(2.12) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asa_5550_firmware:9.13\(0.33\):*:*:*:*:*:*:* | 9.13(0.33) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asa_5550:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:asa_5555-x_firmware:9.12\(2.12\):*:*:*:*:*:*:* | 9.12(2.12) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asa_5555-x_firmware:9.13\(0.33\):*:*:*:*:*:*:* | 9.13(0.33) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:asa_5580_firmware:9.12\(2.12\):*:*:*:*:*:*:* | 9.12(2.12) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asa_5580_firmware:9.13\(0.33\):*:*:*:*:*:*:* | 9.13(0.33) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:asa_5585-x_firmware:9.12\(2.12\):*:*:*:*:*:*:* | 9.12(2.12) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:asa_5585-x_firmware:9.13\(0.33\):*:*:*:*:*:*:* | 9.13(0.33) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:h:cisco:asa_5510:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:asa_5512-x_firmware:9.12\(2.12\):*:*:*:*:*:*:* Versions 9.12(2.12) Vulnerable ·Cisco
- cpe:2.3:o:cisco:asa_5512-x_firmware:9.13\(0.33\):*:*:*:*:*:*:* Versions 9.13(0.33) Vulnerable ·Cisco
- cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:asa_5515-x_firmware:9.12\(2.12\):*:*:*:*:*:*:* Versions 9.12(2.12) Vulnerable ·Cisco
- cpe:2.3:o:cisco:asa_5515-x_firmware:9.13\(0.33\):*:*:*:*:*:*:* Versions 9.13(0.33) Vulnerable ·Cisco
- cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:asa_5520_firmware:9.12\(2.12\):*:*:*:*:*:*:* Versions 9.12(2.12) Vulnerable ·Cisco
- cpe:2.3:o:cisco:asa_5520_firmware:9.13\(0.33\):*:*:*:*:*:*:* Versions 9.13(0.33) Vulnerable ·Cisco
- cpe:2.3:h:cisco:asa_5520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:asa_5525-x_firmware:9.12\(2.12\):*:*:*:*:*:*:* Versions 9.12(2.12) Vulnerable ·Cisco
- cpe:2.3:o:cisco:asa_5525-x_firmware:9.13\(0.33\):*:*:*:*:*:*:* Versions 9.13(0.33) Vulnerable ·Cisco
- cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:asa_5540_firmware:9.12\(2.12\):*:*:*:*:*:*:* Versions 9.12(2.12) Vulnerable ·Cisco
- cpe:2.3:o:cisco:asa_5540_firmware:9.13\(0.33\):*:*:*:*:*:*:* Versions 9.13(0.33) Vulnerable ·Cisco
- cpe:2.3:h:cisco:asa_5540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:asa_5545-x_firmware:9.12\(2.12\):*:*:*:*:*:*:* Versions 9.12(2.12) Vulnerable ·Cisco
- cpe:2.3:o:cisco:asa_5545-x_firmware:9.13\(0.33\):*:*:*:*:*:*:* Versions 9.13(0.33) Vulnerable ·Cisco
- cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:asa_5550_firmware:9.12\(2.12\):*:*:*:*:*:*:* Versions 9.12(2.12) Vulnerable ·Cisco
- cpe:2.3:o:cisco:asa_5550_firmware:9.13\(0.33\):*:*:*:*:*:*:* Versions 9.13(0.33) Vulnerable ·Cisco
- cpe:2.3:h:cisco:asa_5550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:asa_5555-x_firmware:9.12\(2.12\):*:*:*:*:*:*:* Versions 9.12(2.12) Vulnerable ·Cisco
- cpe:2.3:o:cisco:asa_5555-x_firmware:9.13\(0.33\):*:*:*:*:*:*:* Versions 9.13(0.33) Vulnerable ·Cisco
- cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:asa_5580_firmware:9.12\(2.12\):*:*:*:*:*:*:* Versions 9.12(2.12) Vulnerable ·Cisco
- cpe:2.3:o:cisco:asa_5580_firmware:9.13\(0.33\):*:*:*:*:*:*:* Versions 9.13(0.33) Vulnerable ·Cisco
- cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:asa_5585-x_firmware:9.12\(2.12\):*:*:*:*:*:*:* Versions 9.12(2.12) Vulnerable ·Cisco
- cpe:2.3:o:cisco:asa_5585-x_firmware:9.13\(0.33\):*:*:*:*:*:*:* Versions 9.13(0.33) Vulnerable ·Cisco
- cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-3283
- 2026-10-03 Alias added: GHSA-v2w7-xjpq-rmv5
References
More Cisco Asa 5505 Firmware vulnerabilities
- TI-2020-02748 Path traversal in Cisco Adaptive Security Appliance Software CVSS 3.1CRITICAL 9.1
- TI-2021-17312 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Denial of Service Vulnerability CVSS 3.1HIGH 8.6
- TI-2020-02757 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Denial of Service Vulnerability CVSS 3.1HIGH 8.6
- TI-2020-02752 Improper input validation in Cisco Adaptive Security Appliance Software CVSS 3.1HIGH 8.6
- TI-2020-02750 Cisco Firepower Threat Defense Software VPN System Logging Denial of Service Vulnerability CVSS 3.1HIGH 8.6
- TI-2020-02687 Cisco Adaptive Security Appliance Software Kerberos Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-3283 · CVE Program
- CVE-2020-3283 · NVD
- FIRST EPSS
- GHSA-v2w7-xjpq-rmv5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences