Denial of Service Vulnerability in Cisco Adaptive Security Appliance and Firepower Threat Defense

CVE-2022-20927

Summary

A vulnerability exists in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. This issue stems from improper memory management during the initiation of SSL/TLS connections. An authenticated remote attacker can exploit this vulnerability by directing the affected device to connect to an SSL/TLS server configured with specific encryption parameters. If successful, this exploitation can lead to an unexpected reload of the device, resulting in a denial of service condition. It is crucial for organizations using Cisco's ASA and FTD to apply necessary security patches and follow best practices to mitigate this risk.

References