CVE-2020-3283: Cisco Firepower 1000 Series SSL/TLS Denial of Service Vulnerability

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-06 · updated 2026-08-11
Weakness: CWE-119

Description

A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco Firepower Threat Defense (FTD) Software when running on the Cisco Firepower 1000 Series platform could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to a communication error between internal functions. An attacker could exploit this vulnerability by sending a crafted SSL/TLS message to an affected device. A successful exploit could allow the attacker to cause a buffer underrun, which leads to a crash. The crash causes the affected device to reload.

Affected products

Cisco Asa 5505 Firmware: 9.12(2.12), 9.13(0.33)
Cisco Asa 5510 Firmware: 9.12(2.12), 9.13(0.33)
Cisco Asa 5512-X Firmware: 9.12(2.12), 9.13(0.33)
Cisco Asa 5515-X Firmware: 9.12(2.12), 9.13(0.33)
Cisco Asa 5520 Firmware: 9.12(2.12), 9.13(0.33)
Cisco Asa 5525-X Firmware: 9.12(2.12), 9.13(0.33)
Cisco Asa 5540 Firmware: 9.12(2.12), 9.13(0.33)
Cisco Asa 5545-X Firmware: 9.12(2.12), 9.13(0.33)
Cisco Asa 5550 Firmware: 9.12(2.12), 9.13(0.33)
Cisco Asa 5555-X Firmware: 9.12(2.12), 9.13(0.33)
Cisco Asa 5580 Firmware: 9.12(2.12), 9.13(0.33)
Cisco Asa 5585-X Firmware: 9.12(2.12), 9.13(0.33)
Cisco Firepower Threat Defense Software: from 6.4.0 before 6.4.0.9 — fixed in 6.4.0.9

How to fix

Upgrade to a fixed version: Cisco Firepower Threat Defense Software 6.4.0.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-3283 or the next vulnerability affects your stack