1. Home
  2. CVE Database
  3. CVE-2020-3195
HIGH · 7.5

CVE-2020-3195

A vulnerability in the Open Shortest Path First (OSPF) implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticat...

Vulnerability Description

A vulnerability in the Open Shortest Path First (OSPF) implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. The vulnerability is due to incorrect processing of certain OSPF packets. An attacker could exploit this vulnerability by sending a series of crafted OSPF packets to be processed by an affected device. A successful exploit could allow the attacker to continuously consume memory on an affected device and eventually cause it to reload, resulting in a denial of service (DoS) condition.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
CiscoFirepower Threat Defense>= 6.4.0, < 6.4.0.9
CiscoAsa 5505 Firmware9.12\(2\)
CiscoAsa 5505-
CiscoAsa 5510 Firmware9.12\(2\)
CiscoAsa 5510-
CiscoAsa 5512-X Firmware9.12\(2\)
CiscoAsa 5512-X-
CiscoAsa 5515-X Firmware9.12\(2\)
CiscoAsa 5515-X-
CiscoAsa 5520 Firmware9.12\(2\)
CiscoAsa 5520-
CiscoAsa 5525-X Firmware9.12\(2\)
CiscoAsa 5525-X-
CiscoAsa 5540 Firmware9.12\(2\)
CiscoAsa 5540-
CiscoAsa 5545-X Firmware9.12\(2\)
CiscoAsa 5545-X-
CiscoAsa 5550 Firmware9.12\(2\)
CiscoAsa 5550-
CiscoAsa 5555-X Firmware9.12\(2\)

Related Weaknesses (CWE)

CWE-401CWE-400

References

FAQ

What is CVE-2020-3195?

CVE-2020-3195 is a vulnerability with a CVSS score of 7.5 (HIGH). A vulnerability in the Open Shortest Path First (OSPF) implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticat...

How severe is CVE-2020-3195?

CVE-2020-3195 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-3195?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Firepower Threat Defense, Cisco Asa 5505 Firmware, Cisco Asa 5505, Cisco Asa 5510 Firmware, Cisco Asa 5510.