Lucene search

K
cve[email protected]CVE-2019-12700
HistoryOct 02, 2019 - 7:15 p.m.

CVE-2019-12700

2019-10-0219:15:13
CWE-400
web.nvd.nist.gov
27
cisco
firepower
threat defense
ftd
management center
fmc
fxos
pam
dos
ssh
nvd
cve-2019-12700

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.4 Medium

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C

0.001 Low

EPSS

Percentile

45.1%

A vulnerability in the configuration of the Pluggable Authentication Module (PAM) used in Cisco Firepower Threat Defense (FTD) Software, Cisco Firepower Management Center (FMC) Software, and Cisco FXOS Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper resource management in the context of user session management. An attacker could exploit this vulnerability by connecting to an affected system and performing many simultaneous successful Secure Shell (SSH) logins. A successful exploit could allow the attacker to exhaust system resources and cause the device to reload, resulting in a DoS condition. To exploit this vulnerability, the attacker needs valid user credentials on the system.

Affected configurations

NVD
Node
ciscofirepower_9300_firmwareMatchr114
OR
ciscofirepower_9300_firmwareMatchr241
AND
ciscofirepower_9300Match-
Node
ciscofirepower_extensible_operating_systemRange2.2
OR
ciscofirepower_extensible_operating_systemRange2.32.3.1.155
OR
ciscofirepower_extensible_operating_systemRange2.42.6.1.131
Node
ciscofirepower_management_centerRange6.1.0
OR
ciscofirepower_management_centerRange6.2.06.2.3.14
OR
ciscofirepower_threat_defenseRange6.1.0
OR
ciscofirepower_threat_defenseRange6.2.06.2.3.14
AND
ciscofirepower_1000Match-
OR
ciscofirepower_2100Match-
Node
ciscofirepower_management_centerRange6.1.0
OR
ciscofirepower_management_centerRange6.2.06.2.3.14
OR
ciscofirepower_management_centerRange6.2.36.2.3.7
OR
ciscofirepower_threat_defenseRange6.1.0
OR
ciscofirepower_threat_defenseRange6.2.06.2.2.5
OR
ciscofirepower_threat_defenseRange6.2.36.2.3.7

CNA Affected

[
  {
    "product": "Cisco Firepower Management Center ",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "n/a",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.4 Medium

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C

0.001 Low

EPSS

Percentile

45.1%