Cisco ASA Uncontrolled Resource Consumption (CVE-2020-3254)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506078);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/06");

  script_cve_id("CVE-2020-3254");
  script_xref(name:"CEA-ID", value:"CEA-2020-0042");

  script_name(english:"Cisco ASA Uncontrolled Resource Consumption (CVE-2020-3254)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Multiple vulnerabilities in the Media Gateway Control Protocol (MGCP)
inspection feature of Cisco Adaptive Security Appliance (ASA) Software
and Firepower Threat Defense (FTD) Software could allow an
unauthenticated, remote attacker to cause a denial of service (DoS)
condition on an affected device. The vulnerabilities are due to
inefficient memory management. An attacker could exploit these
vulnerabilities by sending crafted MGCP packets through an affected
device. An exploit could allow the attacker to cause memory exhaustion
resulting in a restart of an affected device, causing a DoS condition
for traffic traversing the device.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-mgcp-SUqB8VKH
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?84c4cd75");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-3254");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(400);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/05/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.6" :
        {"versionEndExcluding" : "9.6.4.34", "versionStartIncluding" : "9.6", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.8" :
        {"versionEndExcluding" : "9.8.4.7", "versionStartIncluding" : "9.8", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.9" :
        {"versionEndExcluding" : "9.9.2.66", "versionStartIncluding" : "9.9", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.10" :
        {"versionEndExcluding" : "9.10.1.27", "versionStartIncluding" : "9.10", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.12" :
        {"versionEndExcluding" : "9.12.2.1", "versionStartIncluding" : "9.12", "family" : "CiscoFirepower"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);