CVE-2020-3334: Cisco Firepower 2100 Series Security Appliances ARP Denial of Service Vulnerability

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-06 · updated 2026-08-11
Weakness: CWE-399

Description

A vulnerability in the ARP packet processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Security Appliances could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect processing of ARP packets received by the management interface of an affected device. An attacker could exploit this vulnerability by sending a series of unicast ARP packets in a short timeframe that would reach the management interface of an affected device. A successful exploit could allow the attacker to consume resources on an affected device, which would prevent the device from sending internal system keepalives and eventually cause the device to reload, resulting in a denial of service (DoS) condition.

Affected products

Cisco ASA Software: from 9.10 before 9.10.1.37; from 9.12 before 9.12.3; from 9.13 before 9.13.1.2 — fixed in 9.10.1.37, 9.12.3, 9.13.1.2
Cisco Firepower Threat Defense Software: before 6.6.0 — fixed in 6.6.0

How to fix

Upgrade to a fixed version: Cisco ASA Software 9.10.1.37, 9.12.3, 9.13.1.2; Cisco Firepower Threat Defense Software 6.6.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-3334 or the next vulnerability affects your stack