Detections
Analytics

Cisco Firepower Threat Defense Software Remote Access VPN Brute Force DoS (cisco-sa-asaftd-bf-dos-vDZhLqrW)

medium Nessus Plugin ID 209988

Synopsis

The remote device is missing a vendor-supplied security patch

Description

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a vulnerability.

 - A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. This vulnerability is due to resource exhaustion.
 An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected. Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials. (CVE-2024-20481)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwj45822, CSCwj91570

See Also

http://www.nessus.org/u?900fd680

http://www.nessus.org/u?a871e3b3

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwj45822

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwj91570

Plugin Details

Severity: Medium

ID: 209988

File Name: cisco-sa-asaftd-bf-dos-vDZhLqrW-ftd.nasl

Version: 1.1

Type: local

Family: CISCO

Published: 10/31/2024

Updated: 10/31/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2024-20481

CVSS v3

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 5.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:firepower_threat_defense

Required KB Items: installed_sw/Cisco Firepower Threat Defense

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/23/2024

Vulnerability Publication Date: 10/23/2024

CISA Known Exploited Vulnerability Due Dates: 11/14/2024

Reference Information

CVE: CVE-2024-20481