Common Weakness Enumeration

CWE-788

Weakness Discouraged

Access of Memory Location After End of Buffer

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.

Dimensions

  • Behavior-Type: Access
  • Resource-Type: Memory Location
  • Resource-Property: After End
  • Resource-Type: Buffer
Mapping guidance

The CWE entry might be misused when lower-level CWE entries might be available. It also overlaps existing CWE entries and might be deprecated in the future.

If the "Access" operation is known to be a read or a write, then investigate children of entries such as CWE-787: Out-of-bounds Write and CWE-125: Out-of-bounds Read.

Relationships and members
ChildOf: CWE-119 · View CWE-1000
ChildOf: CWE-119 · View CWE-1305
ChildOf: CWE-119 · View CWE-1340
Overlaps: CWE-126 (symmetric) · View CWE-1000
  • Behavior-Type: Read
  • Behavior-Property: Over
Overlaps: CWE-787 (symmetric) · View CWE-1000
  • Behavior-Type: Write
  • Behavior-Property: Out-of-bounds
Modes of introduction
Implementation

This typically occurs when a pointer or its index is incremented to a position after the buffer; or when pointer arithmetic results in a position after the buffer.

Detection methods

Fuzzing

Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.

Effectiveness: High

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Automated Dynamic Analysis

Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].

Effectiveness: Moderate

Crafted inputs are necessary to reach the code containing the error, such as generated by fuzzers. Also, these tools may reduce performance, and they only report the error condition - not the original mistake that led to the error.

Content history
Submission: CWE Content Team · MITRE · 2009-10-21 · CWE 1.6
Contribution: Eric Constantin Brinz · GENIA-SEC IT-Sicherheitsmanagement GmbH · 2022-02-23 · CWE 4.7

Suggested corrections to extended description.

Modification: CWE Content Team · MITRE · 2011-06-01 · CWE 1.13

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated Common_Consequences, Demonstrative_Examples, Observed_Examples, Relationships

Modification: CWE Content Team · MITRE · 2013-02-21 · CWE 2.4

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2014-06-23 · CWE 2.7

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2015-12-07 · CWE 2.9

updated Description

Modification: CWE Content Team · MITRE · 2017-05-03 · CWE 2.11

updated Description

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Common_Consequences, Demonstrative_Examples, Observed_Examples

Modification: CWE Content Team · MITRE · 2019-01-03 · CWE 3.2

updated References, Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Relationships

Modification: CWE Content Team · MITRE · 2020-06-25 · CWE 4.1

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2020-08-20 · CWE 4.2

updated Relationships

Modification: CWE Content Team · MITRE · 2020-12-10 · CWE 4.3

updated Relationships

Modification: CWE Content Team · MITRE · 2021-07-20 · CWE 4.5

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2022-04-28 · CWE 4.7

updated Description

Modification: CWE Content Team · MITRE · 2023-01-31 · CWE 4.10

updated Description

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Detection_Factors, Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2024-07-16 · CWE 4.15

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2025-04-03 · CWE 4.17

updated Applicable_Platforms

Modification: CWE Content Team · MITRE · 2025-09-09 · CWE 4.18

updated Affected_Resources, Demonstrative_Examples, Functional_Areas

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Applicable_Platforms, Detection_Factors, References, Time_of_Introduction, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Demonstrative_Examples, Description, Dimensions, Modes_of_Introduction, References, Relationships

283 vulnerabilities reference this CWE, most recent first.

CVE-2026-25584 (GCVE-0-2026-25584)

Vulnerability from cvelistv5 – Published: 2026-02-04 22:11 – Updated: 2026-02-05 15:08
VLAI
Title
iccDEV vulnerable to Stack-based Buffer Overflow in CIccTagFloatNum::GetValues()
Summary
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a stack-buffer-overflow vulnerability in CIccTagFloatNum<>::GetValues(). This is triggered when processing a malformed ICC profile. The vulnerability allows an out-of-bounds write on the stack, potentially leading to memory corruption, information disclosure, or code execution when processing specially crafted ICC files. This issue has been patched in version 2.3.1.3.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-05 15:08 UTC
CWE
  • CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-121 - Stack-based Buffer Overflow
  • CWE-787 - Out-of-bounds Write
  • CWE-788 - Access of Memory Location After End of Buffer
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7868 records in the last 180 days details
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25584",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-05T15:08:06.324500Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-05T15:08:25.732Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iccDEV",
          "vendor": "InternationalColorConsortium",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a stack-buffer-overflow vulnerability in CIccTagFloatNum\u003c\u003e::GetValues(). This is triggered when processing a malformed ICC profile. The vulnerability allows an out-of-bounds write on the stack, potentially leading to memory corruption, information disclosure, or code execution when processing specially crafted ICC files. This issue has been patched in version 2.3.1.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-788",
              "description": "CWE-788: Access of Memory Location After End of Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-04T22:11:10.830Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-xjr3-v3vr-5794",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-xjr3-v3vr-5794"
        },
        {
          "name": "https://github.com/InternationalColorConsortium/iccDEV/issues/551",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InternationalColorConsortium/iccDEV/issues/551"
        },
        {
          "name": "https://github.com/InternationalColorConsortium/iccDEV/pull/565",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InternationalColorConsortium/iccDEV/pull/565"
        },
        {
          "name": "https://github.com/InternationalColorConsortium/iccDEV/commit/c9cb108f58683bd87afca616dea3e4cdb884c23f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/InternationalColorConsortium/iccDEV/commit/c9cb108f58683bd87afca616dea3e4cdb884c23f"
        }
      ],
      "source": {
        "advisory": "GHSA-xjr3-v3vr-5794",
        "discovery": "UNKNOWN"
      },
      "title": "iccDEV vulnerable to Stack-based Buffer Overflow in CIccTagFloatNum::GetValues()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25584",
    "datePublished": "2026-02-04T22:11:10.830Z",
    "dateReserved": "2026-02-03T01:02:46.715Z",
    "dateUpdated": "2026-02-05T15:08:25.732Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-21316 (GCVE-0-2026-21316)

Vulnerability from cvelistv5 – Published: 2026-02-10 17:45 – Updated: 2026-08-27 22:02
VLAI
Title
Audition | Access of Memory Location After End of Buffer (CWE-788)
Summary
Audition versions 25.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-11 15:21 UTC
CWE
  • CWE-788 - Access of Memory Location After End of Buffer (CWE-788)
Assigner
adobe CNA under the mitre root
CNA scorecard C 75/100 over 879 records in the last 180 days details
References
Impacted products
Vendor Product Version
Adobe Audition Affected: 0 , ≤ 25.3 (semver)
Unaffected: 25.6 (semver)
Unaffected: 26.0 (semver)
Create a notification for this product.
Date Public
2026-02-10 17:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21316",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-11T15:21:33.304851Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-11T15:21:45.604Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Audition",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "25.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "25.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "26.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-02-10T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Audition versions 25.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "HIGH",
            "modifiedConfidentialityImpact": "NONE",
            "modifiedIntegrityImpact": "NONE",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "UNCHANGED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-788",
              "description": "Access of Memory Location After End of Buffer (CWE-788)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T22:02:43.819Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/audition/apsb26-14.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Audition | Access of Memory Location After End of Buffer (CWE-788)",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2026-21316",
    "datePublished": "2026-02-10T17:45:15.912Z",
    "dateReserved": "2025-12-12T22:01:18.193Z",
    "dateUpdated": "2026-08-27T22:02:43.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20052 (GCVE-0-2026-20052)

Vulnerability from cvelistv5 – Published: 2026-03-04 17:46 – Updated: 2026-03-04 20:46
VLAI
Title
Cisco Secure Firewall Threat Defense Software Snort 3 Memory Management Denial of Service Vulnerability
Summary
A vulnerability in the memory management handling for the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a logic error in memory management when a device is performing Snort 3 SSL packet inspection. An attacker could exploit this vulnerability by sending crafted SSL packets through an established connection to be parsed by the Snort 3 Detection Engine. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine unexpectedly restarts.
Severity
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-04 20:46 UTC
CWE
  • CWE-788 - Access of Memory Location After End of Buffer
Assigner
cisco CNA under the mitre root
CNA scorecard C 66/100 over 431 records in the last 180 days details
References
Impacted products
Vendor Product Version
Cisco Cisco Secure Firewall Threat Defense (FTD) Software Affected: 7.4.0
Affected: 7.4.1
Affected: 7.4.1.1
Affected: 7.6.0
Affected: 7.4.2
Affected: 7.4.2.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20052",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-04T20:46:35.971901Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-04T20:46:43.211Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Secure Firewall Threat Defense (FTD) Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7.4.0"
            },
            {
              "status": "affected",
              "version": "7.4.1"
            },
            {
              "status": "affected",
              "version": "7.4.1.1"
            },
            {
              "status": "affected",
              "version": "7.6.0"
            },
            {
              "status": "affected",
              "version": "7.4.2"
            },
            {
              "status": "affected",
              "version": "7.4.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the memory management handling for the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart.\r\n\r\nThis vulnerability is due to a logic error in memory management when a device is performing Snort 3 SSL packet inspection. An attacker could exploit this vulnerability by sending crafted SSL packets\u0026nbsp;through an established connection to be parsed by the Snort 3 Detection Engine. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine unexpectedly restarts."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-788",
              "description": "Access of Memory Location After End of Buffer",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-04T17:46:57.096Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ftd-snort3ssl-FBEKYXpH",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3ssl-FBEKYXpH"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ftd-snort3ssl-FBEKYXpH",
        "defects": [
          "CSCwn63410"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Secure Firewall Threat Defense Software Snort 3 Memory Management Denial of Service Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-20052",
    "datePublished": "2026-03-04T17:46:57.096Z",
    "dateReserved": "2025-10-08T11:59:15.355Z",
    "dateUpdated": "2026-03-04T20:46:43.211Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43580 (GCVE-0-2025-43580)

Vulnerability from cvelistv5 – Published: 2025-07-08 16:30 – Updated: 2025-07-09 14:14
VLAI
Title
Audition | Access of Memory Location After End of Buffer (CWE-788)
Summary
Audition versions 25.2, 24.6.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could result in application denial-of-service. An attacker could leverage this vulnerability to crash the application or disrupt its functionality. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-09 14:14 UTC
CWE
  • CWE-788 - Access of Memory Location After End of Buffer (CWE-788)
Assigner
adobe CNA under the mitre root
CNA scorecard C 75/100 over 879 records in the last 180 days details
References
Impacted products
Vendor Product Version
Adobe Audition Affected: 0 , ≤ 24.6.3 (semver)
Create a notification for this product.
Date Public
2025-07-08 17:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-43580",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-09T14:14:17.984973Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-09T14:14:25.146Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Audition",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "24.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2025-07-08T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Audition versions 25.2, 24.6.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could result in application denial-of-service. An attacker could leverage this vulnerability to crash the application or disrupt its functionality. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 5.5,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "NONE",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "HIGH",
            "modifiedConfidentialityImpact": "NONE",
            "modifiedIntegrityImpact": "NONE",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "UNCHANGED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 5.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-788",
              "description": "Access of Memory Location After End of Buffer (CWE-788)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-08T16:30:27.184Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/audition/apsb25-56.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Audition | Access of Memory Location After End of Buffer (CWE-788)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2025-43580",
    "datePublished": "2025-07-08T16:30:27.184Z",
    "dateReserved": "2025-04-16T16:23:13.182Z",
    "dateUpdated": "2025-07-09T14:14:25.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-36581 (GCVE-0-2025-36581)

Vulnerability from cvelistv5 – Published: 2025-08-14 14:00 – Updated: 2025-08-14 14:34
VLAI
Summary
Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
Severity
3.8 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-14 14:34 UTC
CWE
  • CWE-788 - Access of Memory Location After End of Buffer
Assigner
dell CNA under the mitre root
CNA scorecard C 70/100 over 575 records in the last 180 days details
References
Impacted products
Vendor Product Version
Dell PowerEdge Affected: N/A , < 1.26.0 (semver)
Create a notification for this product.
Date Public
2025-08-13 17:00
Credits
Dell would like to thank codebreaker1337 for reporting this issue
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-36581",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-14T14:34:05.254583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-14T14:34:35.216Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PowerEdge",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "1.26.0",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dell would like to thank codebreaker1337 for reporting this issue"
        }
      ],
      "datePublic": "2025-08-13T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure."
            }
          ],
          "value": "Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-788",
              "description": "CWE-788: Access of Memory Location After End of Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-14T14:00:11.677Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dell.com/support/kbdoc/en-us/000356405/dsa-2025-299-security-update-for-dell-poweredge-server-bios-for-an-access-of-memory-location-after-end-of-buffer-vulnerability"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2025-36581",
    "datePublished": "2025-08-14T14:00:11.677Z",
    "dateReserved": "2025-04-15T21:30:44.885Z",
    "dateUpdated": "2025-08-14T14:34:35.216Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-42425 (GCVE-0-2024-42425)

Vulnerability from cvelistv5 – Published: 2024-09-10 08:17 – Updated: 2024-09-10 15:08
VLAI
Summary
Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
Severity
3.8 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:08 UTC
CWE
  • CWE-788 - Access of Memory Location After End of Buffer
Assigner
dell CNA under the mitre root
CNA scorecard C 70/100 over 575 records in the last 180 days details
References
Impacted products
Vendor Product Version
Dell Dell Precision Rack BIOS Affected: N/A , < 2.22.1 (semver)
Create a notification for this product.
Date Public
2024-09-05 06:30
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42425",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:08:42.622659Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T15:08:54.037Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Dell Precision Rack BIOS",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "2.22.1",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-09-05T06:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure."
            }
          ],
          "value": "Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-788",
              "description": "CWE-788: Access of Memory Location After End of Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-10T08:17:04.690Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dell.com/support/kbdoc/en-us/000227015/dsa-2024-328"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2024-42425",
    "datePublished": "2024-09-10T08:17:04.690Z",
    "dateReserved": "2024-08-01T07:28:53.702Z",
    "dateUpdated": "2024-09-10T15:08:54.037Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38304 (GCVE-0-2024-38304)

Vulnerability from cvelistv5 – Published: 2024-08-29 08:03 – Updated: 2024-08-29 13:28
VLAI
Summary
Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
Severity
3.8 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-29 13:28 UTC
CWE
  • CWE-788 - Access of Memory Location After End of Buffer
Assigner
dell CNA under the mitre root
CNA scorecard C 70/100 over 575 records in the last 180 days details
References
Impacted products
Vendor Product Version
Dell PowerEdge Platform Affected: N/A , < 2.22.1 (semver)
Affected: N/A , < 2.22.0 (semver)
Create a notification for this product.
Date Public
2024-08-28 06:30
Credits
Dell would like to thank codebreaker1337 for reporting this issue.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38304",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-29T13:28:25.124614Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-29T13:28:35.429Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PowerEdge Platform",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "2.22.1",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            },
            {
              "lessThan": "2.22.0",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dell would like to thank codebreaker1337 for reporting this issue."
        }
      ],
      "datePublic": "2024-08-28T06:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure."
            }
          ],
          "value": "Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-788",
              "description": "CWE-788: Access of Memory Location After End of Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-29T08:03:40.261Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dell.com/support/kbdoc/en-us/000228137/dsa-2024-310-security-update-for-dell-poweredge-server-for-access-of-memory-location-after-end-of-buffer-vulnerability"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2024-38304",
    "datePublished": "2024-08-29T08:03:40.261Z",
    "dateReserved": "2024-06-13T14:41:01.527Z",
    "dateUpdated": "2024-08-29T13:28:35.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-21618 (GCVE-0-2024-21618)

Vulnerability from cvelistv5 – Published: 2024-04-12 14:55 – Updated: 2024-08-01 22:27
VLAI
Title
Junos OS and Junos OS Evolved: When LLDP is enabled and a malformed LLDP packet is received, l2cpd crashes
Summary
An Access of Memory Location After End of Buffer vulnerability in the Layer-2 Control Protocols Daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause Denial of Service (DoS). On all Junos OS and Junos OS Evolved platforms, when LLDP is enabled on a specific interface, and a malformed LLDP packet is received, l2cpd crashes and restarts. The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP. Also, if any services depend on LLDP state (like PoE or VoIP device recognition), then these will also be affected. This issue affects: Junos OS: * from 21.4 before 21.4R3-S4,  * from 22.1 before 22.1R3-S4,  * from 22.2 before 22.2R3-S2,  * from 22.3 before 22.3R2-S2, 22.3R3-S1,  * from 22.4 before 22.4R3,  * from 23.2 before 23.2R2. Junos OS Evolved: * from 21.4-EVO before 21.4R3-S5-EVO,  * from 22.1-EVO before 22.1R3-S4-EVO,  * from 22.2-EVO before 22.2R3-S2-EVO,  * from 22.3-EVO before 22.3R2-S2-EVO, 22.3R3-S1-EVO,  * from 22.4-EVO before 22.4R3-EVO,  * from 23.2-EVO before 23.2R2-EVO. This issue does not affect: * Junos OS versions prior to 21.4R1; * Junos OS Evolved versions prior to 21.4R1-EVO.
Severity
6.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.1 (High)
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-11 13:59 UTC
CWE
  • CWE-788 - Access of Memory Location After End of Buffer
  • Denial of Service (DoS)
Assigner
juniper CNA under the mitre root
CNA scorecard B 84/100 over 193 records in the last 180 days details
References
Impacted products
Vendor Product Version
Juniper Networks Junos OS Affected: 21.4 , < 21.4R3-S4 (semver)
Affected: 22.1 , < 22.1R3-S4 (semver)
Affected: 22.2 , < 22.2R3-S2 (semver)
Affected: 22.3 , < 22.3R2-S2, 22.3R3-S1 (semver)
Affected: 22.4 , < 22.4R3 (semver)
Affected: 23.2 , < 23.2R2 (semver)
Unaffected: 0 , < 21.4R1 (semver)
Create a notification for this product.
Juniper Networks Junos OS Evolved Affected: 21.4-EVO , < 21.4R3-S5-EVO (semver)
Affected: 22.1-EVO , < 22.1R3-S4-EVO (semver)
Affected: 22.2-EVO , < 22.2R3-S2-EVO (semver)
Affected: 22.3-EVO , < 22.3R2-S2-EVO, 22.3R3-S1-EVO (semver)
Affected: 22.4-EVO , < 22.4R3-EVO (semver)
Affected: 23.2-EVO , < 23.2R2-EVO (semver)
Unaffected: 0 , < 21.4R1-EVO (semver)
Create a notification for this product.
Date Public
2024-04-10 17:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21618",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-11T13:59:35.301594Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-11T13:59:57.501Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:27:35.779Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://supportportal.juniper.net/JSA75759"
          },
          {
            "tags": [
              "technical-description",
              "x_transferred"
            ],
            "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "21.4R3-S4",
              "status": "affected",
              "version": "21.4",
              "versionType": "semver"
            },
            {
              "lessThan": "22.1R3-S4",
              "status": "affected",
              "version": "22.1",
              "versionType": "semver"
            },
            {
              "lessThan": "22.2R3-S2",
              "status": "affected",
              "version": "22.2",
              "versionType": "semver"
            },
            {
              "lessThan": "22.3R2-S2, 22.3R3-S1",
              "status": "affected",
              "version": "22.3",
              "versionType": "semver"
            },
            {
              "lessThan": "22.4R3",
              "status": "affected",
              "version": "22.4",
              "versionType": "semver"
            },
            {
              "lessThan": "23.2R2",
              "status": "affected",
              "version": "23.2",
              "versionType": "semver"
            },
            {
              "lessThan": "21.4R1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Junos OS Evolved",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "21.4R3-S5-EVO",
              "status": "affected",
              "version": "21.4-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "22.1R3-S4-EVO",
              "status": "affected",
              "version": "22.1-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "22.2R3-S2-EVO",
              "status": "affected",
              "version": "22.2-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "22.3R2-S2-EVO, 22.3R3-S1-EVO",
              "status": "affected",
              "version": "22.3-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "22.4R3-EVO",
              "status": "affected",
              "version": "22.4-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "23.2R2-EVO",
              "status": "affected",
              "version": "23.2-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "21.4R1-EVO",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThis vulnerability is only exploitable on interfaces with LLDP enabled.\u003c/p\u003e\u003ctt\u003e\u0026nbsp; [protocols lldp interface]\u003c/tt\u003e"
            }
          ],
          "value": "This vulnerability is only exploitable on interfaces with LLDP enabled.\n\n\u00a0 [protocols lldp interface]"
        }
      ],
      "datePublic": "2024-04-10T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An Access of Memory Location After End of Buffer vulnerability in the Layer-2 Control Protocols Daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause Denial of Service (DoS).\u003cbr\u003e\u003cbr\u003eOn all Junos OS and Junos OS Evolved platforms, when LLDP is enabled on a specific interface, and a malformed LLDP packet is received, l2cpd crashes and restarts. The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP. Also, if any services depend on LLDP state (like PoE or VoIP device recognition), then these will also be affected.\u003cbr\u003e\u003cbr\u003eThis issue affects:\u003cbr\u003e\u003cbr\u003eJunos OS:\u003cbr\u003e\u003cul\u003e\u003cli\u003efrom 21.4 before 21.4R3-S4,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.1 before 22.1R3-S4,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.2 before 22.2R3-S2,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.3 before 22.3R2-S2, 22.3R3-S1,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.4 before 22.4R3,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 23.2 before 23.2R2.\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e Junos OS Evolved:\u003cbr\u003e\u003cul\u003e\u003cli\u003efrom 21.4-EVO before 21.4R3-S5-EVO,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.1-EVO before 22.1R3-S4-EVO,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.2-EVO before 22.2R3-S2-EVO,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.3-EVO before 22.3R2-S2-EVO, 22.3R3-S1-EVO,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 22.4-EVO before 22.4R3-EVO,\u0026nbsp;\u003cbr\u003e\u003c/li\u003e\u003cli\u003efrom 23.2-EVO before 23.2R2-EVO.\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003eThis issue does not affect:\u003cbr\u003e\u003cul\u003e\u003cli\u003eJunos OS versions prior to 21.4R1;\u003cbr\u003e\u003c/li\u003e\u003cli\u003eJunos OS Evolved versions prior to 21.4R1-EVO.\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "An Access of Memory Location After End of Buffer vulnerability in the Layer-2 Control Protocols Daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause Denial of Service (DoS).\n\nOn all Junos OS and Junos OS Evolved platforms, when LLDP is enabled on a specific interface, and a malformed LLDP packet is received, l2cpd crashes and restarts. The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP. Also, if any services depend on LLDP state (like PoE or VoIP device recognition), then these will also be affected.\n\nThis issue affects:\n\nJunos OS:\n  *  from 21.4 before 21.4R3-S4,\u00a0\n\n  *  from 22.1 before 22.1R3-S4,\u00a0\n\n  *  from 22.2 before 22.2R3-S2,\u00a0\n\n  *  from 22.3 before 22.3R2-S2, 22.3R3-S1,\u00a0\n\n  *  from 22.4 before 22.4R3,\u00a0\n\n  *  from 23.2 before 23.2R2.\n\n\n\n\n Junos OS Evolved:\n  *  from 21.4-EVO before 21.4R3-S5-EVO,\u00a0\n\n  *  from 22.1-EVO before 22.1R3-S4-EVO,\u00a0\n\n  *  from 22.2-EVO before 22.2R3-S2-EVO,\u00a0\n\n  *  from 22.3-EVO before 22.3R2-S2-EVO, 22.3R3-S1-EVO,\u00a0\n\n  *  from 22.4-EVO before 22.4R3-EVO,\u00a0\n\n  *  from 23.2-EVO before 23.2R2-EVO.\n\n\n\n\nThis issue does not affect:\n  *  Junos OS versions prior to 21.4R1;\n\n  *  Junos OS Evolved versions prior to 21.4R1-EVO."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eJuniper SIRT is not aware of any malicious exploitation of this vulnerability.\u003c/p\u003e"
            }
          ],
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-788",
              "description": "CWE-788: Access of Memory Location After End of Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "Denial of Service (DoS)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-16T20:12:38.203Z",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://supportportal.juniper.net/JSA75759"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe following software releases have been updated to resolve this specific issue:\u003c/p\u003e\u003cp\u003eJunos OS: 21.4R3-S4, 22.1R3-S4, 22.2R3-S2, 22.3R2-S2, 22.3R3-S1, 22.4R3, 23.2R2, 23.4R1 and all subsequent releases.\u003c/p\u003e\u003cp\u003eJunos OS Evolved: 21.4R3-S5-EVO, 22.1R3-S4-EVO, 22.2R3-S2-EVO, 22.3R2-S2-EVO, 22.3R3-S1-EVO, 22.4R3-EVO, 23.2R2-EVO, 23.4R1-EVO and all subsequent releases.\u003c/p\u003e"
            }
          ],
          "value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS: 21.4R3-S4, 22.1R3-S4, 22.2R3-S2, 22.3R2-S2, 22.3R3-S1, 22.4R3, 23.2R2, 23.4R1 and all subsequent releases.\n\nJunos OS Evolved: 21.4R3-S5-EVO, 22.1R3-S4-EVO, 22.2R3-S2-EVO, 22.3R2-S2-EVO, 22.3R3-S1-EVO, 22.4R3-EVO, 23.2R2-EVO, 23.4R1-EVO and all subsequent releases."
        }
      ],
      "source": {
        "advisory": "JSA75759",
        "defect": [
          "1747039"
        ],
        "discovery": "USER"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-10T17:00:00.000Z",
          "value": "Initial Publication"
        }
      ],
      "title": "Junos OS and Junos OS Evolved: When LLDP is enabled and a malformed LLDP packet is received, l2cpd crashes",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThere are no available workarounds for this issue.\u003c/p\u003e\u003cp\u003e\u200b\u200b\u200b\u200b\u200b\u200b\u200b\u003c/p\u003e\u003cp\u003eBut if LLDP and its services are not required, customers can disable LLDP.\u003c/p\u003e"
            }
          ],
          "value": "There are no available workarounds for this issue.\n\n\u200b\u200b\u200b\u200b\u200b\u200b\u200b\n\nBut if LLDP and its services are not required, customers can disable LLDP."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-av217"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2024-21618",
    "datePublished": "2024-04-12T14:55:52.241Z",
    "dateReserved": "2023-12-27T19:38:25.710Z",
    "dateUpdated": "2024-08-01T22:27:35.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-20402 (GCVE-0-2024-20402)

Vulnerability from cvelistv5 – Published: 2024-10-23 17:35 – Updated: 2024-10-24 16:16
VLAI
Summary
A vulnerability in the SSL VPN feature for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to a logic error in memory management when the device is handling SSL VPN connections. An attacker could exploit this vulnerability by sending crafted SSL/TLS packets to the SSL VPN server of the affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-23 18:42 UTC
CWE
  • CWE-788 - Access of Memory Location After End of Buffer
Assigner
cisco CNA under the mitre root
CNA scorecard C 66/100 over 431 records in the last 180 days details
References
Impacted products
Vendor Product Version
Cisco Cisco Adaptive Security Appliance (ASA) Software Affected: 9.8.1
Affected: 9.8.1.5
Affected: 9.8.1.7
Affected: 9.8.2
Affected: 9.8.2.8
Affected: 9.8.2.14
Affected: 9.8.2.15
Affected: 9.8.2.17
Affected: 9.8.2.20
Affected: 9.8.2.24
Affected: 9.8.2.26
Affected: 9.8.2.28
Affected: 9.8.2.33
Affected: 9.8.2.35
Affected: 9.8.2.38
Affected: 9.8.3.8
Affected: 9.8.3.11
Affected: 9.8.3.14
Affected: 9.8.3.16
Affected: 9.8.3.18
Affected: 9.8.3.21
Affected: 9.8.3
Affected: 9.8.3.26
Affected: 9.8.3.29
Affected: 9.8.4
Affected: 9.8.4.3
Affected: 9.8.4.7
Affected: 9.8.4.8
Affected: 9.8.4.10
Affected: 9.8.4.12
Affected: 9.8.4.15
Affected: 9.8.4.17
Affected: 9.8.2.45
Affected: 9.8.4.25
Affected: 9.8.4.20
Affected: 9.8.4.22
Affected: 9.8.4.26
Affected: 9.8.4.29
Affected: 9.8.4.32
Affected: 9.8.4.33
Affected: 9.8.4.34
Affected: 9.8.4.35
Affected: 9.8.4.39
Affected: 9.8.4.40
Affected: 9.8.4.41
Affected: 9.8.4.43
Affected: 9.8.4.44
Affected: 9.8.4.45
Affected: 9.8.4.46
Affected: 9.8.4.48
Affected: 9.12.1
Affected: 9.12.1.2
Affected: 9.12.1.3
Affected: 9.12.2
Affected: 9.12.2.4
Affected: 9.12.2.5
Affected: 9.12.2.9
Affected: 9.12.3
Affected: 9.12.3.2
Affected: 9.12.3.7
Affected: 9.12.4
Affected: 9.12.3.12
Affected: 9.12.3.9
Affected: 9.12.2.1
Affected: 9.12.4.2
Affected: 9.12.4.4
Affected: 9.12.4.7
Affected: 9.12.4.10
Affected: 9.12.4.13
Affected: 9.12.4.8
Affected: 9.12.4.18
Affected: 9.12.4.24
Affected: 9.12.4.26
Affected: 9.12.4.29
Affected: 9.12.4.30
Affected: 9.12.4.35
Affected: 9.12.4.37
Affected: 9.12.4.38
Affected: 9.12.4.39
Affected: 9.12.4.40
Affected: 9.12.4.41
Affected: 9.12.4.47
Affected: 9.12.4.48
Affected: 9.12.4.50
Affected: 9.12.4.52
Affected: 9.12.4.54
Affected: 9.12.4.55
Affected: 9.12.4.56
Affected: 9.12.4.58
Affected: 9.12.4.62
Affected: 9.12.4.65
Affected: 9.12.4.67
Affected: 9.14.1
Affected: 9.14.1.10
Affected: 9.14.1.6
Affected: 9.14.1.15
Affected: 9.14.1.19
Affected: 9.14.1.30
Affected: 9.14.2
Affected: 9.14.2.4
Affected: 9.14.2.8
Affected: 9.14.2.13
Affected: 9.14.2.15
Affected: 9.14.3
Affected: 9.14.3.1
Affected: 9.14.3.9
Affected: 9.14.3.11
Affected: 9.14.3.13
Affected: 9.14.3.18
Affected: 9.14.3.15
Affected: 9.14.4
Affected: 9.14.4.6
Affected: 9.14.4.7
Affected: 9.14.4.12
Affected: 9.14.4.13
Affected: 9.14.4.14
Affected: 9.14.4.15
Affected: 9.14.4.17
Affected: 9.14.4.22
Affected: 9.14.4.23
Affected: 9.14.4.24
Affected: 9.15.1
Affected: 9.15.1.7
Affected: 9.15.1.10
Affected: 9.15.1.15
Affected: 9.15.1.16
Affected: 9.15.1.17
Affected: 9.15.1.1
Affected: 9.15.1.21
Affected: 9.16.1
Affected: 9.16.1.28
Affected: 9.16.2
Affected: 9.16.2.3
Affected: 9.16.2.7
Affected: 9.16.2.11
Affected: 9.16.2.13
Affected: 9.16.2.14
Affected: 9.16.3
Affected: 9.16.3.3
Affected: 9.16.3.14
Affected: 9.16.3.15
Affected: 9.16.3.19
Affected: 9.16.3.23
Affected: 9.16.4
Affected: 9.16.4.9
Affected: 9.16.4.14
Affected: 9.16.4.18
Affected: 9.16.4.19
Affected: 9.16.4.27
Affected: 9.16.4.38
Affected: 9.16.4.39
Affected: 9.16.4.42
Affected: 9.16.4.48
Affected: 9.16.4.55
Affected: 9.16.4.57
Affected: 9.16.4.61
Affected: 9.17.1
Affected: 9.17.1.7
Affected: 9.17.1.9
Affected: 9.17.1.10
Affected: 9.17.1.11
Affected: 9.17.1.13
Affected: 9.17.1.15
Affected: 9.17.1.20
Affected: 9.17.1.30
Affected: 9.17.1.33
Affected: 9.17.1.39
Affected: 9.18.1
Affected: 9.18.1.3
Affected: 9.18.2
Affected: 9.18.2.5
Affected: 9.18.2.7
Affected: 9.18.2.8
Affected: 9.18.3
Affected: 9.18.3.39
Affected: 9.18.3.46
Affected: 9.18.3.53
Affected: 9.18.3.55
Affected: 9.18.3.56
Affected: 9.18.4
Affected: 9.18.4.5
Affected: 9.18.4.8
Affected: 9.18.4.22
Affected: 9.18.4.24
Affected: 9.18.4.29
Affected: 9.19.1
Affected: 9.19.1.5
Affected: 9.19.1.9
Affected: 9.19.1.12
Affected: 9.19.1.18
Affected: 9.19.1.22
Affected: 9.19.1.24
Affected: 9.19.1.27
Affected: 9.19.1.28
Affected: 9.19.1.31
Create a notification for this product.
Cisco Cisco Firepower Threat Defense Software Affected: 6.2.3
Affected: 6.2.3.1
Affected: 6.2.3.2
Affected: 6.2.3.3
Affected: 6.2.3.4
Affected: 6.2.3.5
Affected: 6.2.3.6
Affected: 6.2.3.7
Affected: 6.2.3.8
Affected: 6.2.3.10
Affected: 6.2.3.11
Affected: 6.2.3.9
Affected: 6.2.3.12
Affected: 6.2.3.13
Affected: 6.2.3.14
Affected: 6.2.3.15
Affected: 6.2.3.16
Affected: 6.2.3.17
Affected: 6.2.3.18
Affected: 6.6.0
Affected: 6.6.0.1
Affected: 6.6.1
Affected: 6.6.3
Affected: 6.6.4
Affected: 6.6.5
Affected: 6.6.5.1
Affected: 6.6.5.2
Affected: 6.6.7
Affected: 6.6.7.1
Affected: 6.6.7.2
Affected: 6.4.0
Affected: 6.4.0.1
Affected: 6.4.0.3
Affected: 6.4.0.2
Affected: 6.4.0.4
Affected: 6.4.0.5
Affected: 6.4.0.6
Affected: 6.4.0.7
Affected: 6.4.0.8
Affected: 6.4.0.9
Affected: 6.4.0.10
Affected: 6.4.0.11
Affected: 6.4.0.12
Affected: 6.4.0.13
Affected: 6.4.0.14
Affected: 6.4.0.15
Affected: 6.4.0.16
Affected: 6.4.0.17
Affected: 6.4.0.18
Affected: 6.7.0
Affected: 6.7.0.1
Affected: 6.7.0.2
Affected: 6.7.0.3
Affected: 7.0.0
Affected: 7.0.0.1
Affected: 7.0.1
Affected: 7.0.1.1
Affected: 7.0.2
Affected: 7.0.2.1
Affected: 7.0.3
Affected: 7.0.4
Affected: 7.0.5
Affected: 7.0.6
Affected: 7.0.6.1
Affected: 7.0.6.2
Affected: 7.1.0
Affected: 7.1.0.1
Affected: 7.1.0.2
Affected: 7.1.0.3
Affected: 7.2.0
Affected: 7.2.0.1
Affected: 7.2.1
Affected: 7.2.2
Affected: 7.2.3
Affected: 7.2.4
Affected: 7.2.4.1
Affected: 7.2.5
Affected: 7.2.5.1
Affected: 7.2.6
Affected: 7.2.7
Affected: 7.2.5.2
Affected: 7.2.8
Affected: 7.2.8.1
Affected: 7.3.0
Affected: 7.3.1
Affected: 7.3.1.1
Affected: 7.3.1.2
Create a notification for this product.
cisco adaptive_security_appliance Affected: 9.8.1 , ≤ 9.8.4.48 (custom)
Affected: 9.12.1 , ≤ 9.12.4.67 (custom)
Affected: 9.14.1 , ≤ 9.14.4.24 (custom)
Affected: 9.15.1 , ≤ 9.15.1.21 (custom)
Affected: 9.16.1 , ≤ 9.16.4.61 (custom)
Affected: 9.17.1 , ≤ 9.17.1.39 (custom)
Affected: 9.18.1 , ≤ 9.18.4.29 (custom)
Affected: 9.19.1 , ≤ 9.19.1.31 (custom)
    cpe:2.3:h:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*
Create a notification for this product.
cisco firepower_threat_defense_software Affected: 6.2.3 , ≤ 6.2.3.18 (custom)
Affected: 6.4.0 , ≤ 6.4.0.18 (custom)
Affected: 6.6.0 , ≤ 6.6.7.2 (custom)
Affected: 6.7.0 , ≤ 6.7.0.3 (custom)
Affected: 7.0.0 , ≤ 7.0.6.2 (custom)
Affected: 7.1.0 , ≤ 7.1.0.3 (custom)
Affected: 7.2.0 , ≤ 7.2.8.1 (custom)
Affected: 7.3.0 , ≤ 7.3.1.2 (custom)
    cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:h:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "adaptive_security_appliance",
            "vendor": "cisco",
            "versions": [
              {
                "lessThanOrEqual": "9.8.4.48",
                "status": "affected",
                "version": "9.8.1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.12.4.67",
                "status": "affected",
                "version": "9.12.1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.14.4.24",
                "status": "affected",
                "version": "9.14.1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.15.1.21",
                "status": "affected",
                "version": "9.15.1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.16.4.61",
                "status": "affected",
                "version": "9.16.1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.17.1.39",
                "status": "affected",
                "version": "9.17.1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.18.4.29",
                "status": "affected",
                "version": "9.18.1",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.19.1.31",
                "status": "affected",
                "version": "9.19.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firepower_threat_defense_software",
            "vendor": "cisco",
            "versions": [
              {
                "lessThanOrEqual": "6.2.3.18",
                "status": "affected",
                "version": "6.2.3",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.4.0.18",
                "status": "affected",
                "version": "6.4.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.6.7.2",
                "status": "affected",
                "version": "6.6.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.7.0.3",
                "status": "affected",
                "version": "6.7.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "7.0.6.2",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "7.1.0.3",
                "status": "affected",
                "version": "7.1.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "7.2.8.1",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "7.3.1.2",
                "status": "affected",
                "version": "7.3.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20402",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-23T18:42:40.849857Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-24T16:16:53.323Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Adaptive Security Appliance (ASA) Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "9.8.1"
            },
            {
              "status": "affected",
              "version": "9.8.1.5"
            },
            {
              "status": "affected",
              "version": "9.8.1.7"
            },
            {
              "status": "affected",
              "version": "9.8.2"
            },
            {
              "status": "affected",
              "version": "9.8.2.8"
            },
            {
              "status": "affected",
              "version": "9.8.2.14"
            },
            {
              "status": "affected",
              "version": "9.8.2.15"
            },
            {
              "status": "affected",
              "version": "9.8.2.17"
            },
            {
              "status": "affected",
              "version": "9.8.2.20"
            },
            {
              "status": "affected",
              "version": "9.8.2.24"
            },
            {
              "status": "affected",
              "version": "9.8.2.26"
            },
            {
              "status": "affected",
              "version": "9.8.2.28"
            },
            {
              "status": "affected",
              "version": "9.8.2.33"
            },
            {
              "status": "affected",
              "version": "9.8.2.35"
            },
            {
              "status": "affected",
              "version": "9.8.2.38"
            },
            {
              "status": "affected",
              "version": "9.8.3.8"
            },
            {
              "status": "affected",
              "version": "9.8.3.11"
            },
            {
              "status": "affected",
              "version": "9.8.3.14"
            },
            {
              "status": "affected",
              "version": "9.8.3.16"
            },
            {
              "status": "affected",
              "version": "9.8.3.18"
            },
            {
              "status": "affected",
              "version": "9.8.3.21"
            },
            {
              "status": "affected",
              "version": "9.8.3"
            },
            {
              "status": "affected",
              "version": "9.8.3.26"
            },
            {
              "status": "affected",
              "version": "9.8.3.29"
            },
            {
              "status": "affected",
              "version": "9.8.4"
            },
            {
              "status": "affected",
              "version": "9.8.4.3"
            },
            {
              "status": "affected",
              "version": "9.8.4.7"
            },
            {
              "status": "affected",
              "version": "9.8.4.8"
            },
            {
              "status": "affected",
              "version": "9.8.4.10"
            },
            {
              "status": "affected",
              "version": "9.8.4.12"
            },
            {
              "status": "affected",
              "version": "9.8.4.15"
            },
            {
              "status": "affected",
              "version": "9.8.4.17"
            },
            {
              "status": "affected",
              "version": "9.8.2.45"
            },
            {
              "status": "affected",
              "version": "9.8.4.25"
            },
            {
              "status": "affected",
              "version": "9.8.4.20"
            },
            {
              "status": "affected",
              "version": "9.8.4.22"
            },
            {
              "status": "affected",
              "version": "9.8.4.26"
            },
            {
              "status": "affected",
              "version": "9.8.4.29"
            },
            {
              "status": "affected",
              "version": "9.8.4.32"
            },
            {
              "status": "affected",
              "version": "9.8.4.33"
            },
            {
              "status": "affected",
              "version": "9.8.4.34"
            },
            {
              "status": "affected",
              "version": "9.8.4.35"
            },
            {
              "status": "affected",
              "version": "9.8.4.39"
            },
            {
              "status": "affected",
              "version": "9.8.4.40"
            },
            {
              "status": "affected",
              "version": "9.8.4.41"
            },
            {
              "status": "affected",
              "version": "9.8.4.43"
            },
            {
              "status": "affected",
              "version": "9.8.4.44"
            },
            {
              "status": "affected",
              "version": "9.8.4.45"
            },
            {
              "status": "affected",
              "version": "9.8.4.46"
            },
            {
              "status": "affected",
              "version": "9.8.4.48"
            },
            {
              "status": "affected",
              "version": "9.12.1"
            },
            {
              "status": "affected",
              "version": "9.12.1.2"
            },
            {
              "status": "affected",
              "version": "9.12.1.3"
            },
            {
              "status": "affected",
              "version": "9.12.2"
            },
            {
              "status": "affected",
              "version": "9.12.2.4"
            },
            {
              "status": "affected",
              "version": "9.12.2.5"
            },
            {
              "status": "affected",
              "version": "9.12.2.9"
            },
            {
              "status": "affected",
              "version": "9.12.3"
            },
            {
              "status": "affected",
              "version": "9.12.3.2"
            },
            {
              "status": "affected",
              "version": "9.12.3.7"
            },
            {
              "status": "affected",
              "version": "9.12.4"
            },
            {
              "status": "affected",
              "version": "9.12.3.12"
            },
            {
              "status": "affected",
              "version": "9.12.3.9"
            },
            {
              "status": "affected",
              "version": "9.12.2.1"
            },
            {
              "status": "affected",
              "version": "9.12.4.2"
            },
            {
              "status": "affected",
              "version": "9.12.4.4"
            },
            {
              "status": "affected",
              "version": "9.12.4.7"
            },
            {
              "status": "affected",
              "version": "9.12.4.10"
            },
            {
              "status": "affected",
              "version": "9.12.4.13"
            },
            {
              "status": "affected",
              "version": "9.12.4.8"
            },
            {
              "status": "affected",
              "version": "9.12.4.18"
            },
            {
              "status": "affected",
              "version": "9.12.4.24"
            },
            {
              "status": "affected",
              "version": "9.12.4.26"
            },
            {
              "status": "affected",
              "version": "9.12.4.29"
            },
            {
              "status": "affected",
              "version": "9.12.4.30"
            },
            {
              "status": "affected",
              "version": "9.12.4.35"
            },
            {
              "status": "affected",
              "version": "9.12.4.37"
            },
            {
              "status": "affected",
              "version": "9.12.4.38"
            },
            {
              "status": "affected",
              "version": "9.12.4.39"
            },
            {
              "status": "affected",
              "version": "9.12.4.40"
            },
            {
              "status": "affected",
              "version": "9.12.4.41"
            },
            {
              "status": "affected",
              "version": "9.12.4.47"
            },
            {
              "status": "affected",
              "version": "9.12.4.48"
            },
            {
              "status": "affected",
              "version": "9.12.4.50"
            },
            {
              "status": "affected",
              "version": "9.12.4.52"
            },
            {
              "status": "affected",
              "version": "9.12.4.54"
            },
            {
              "status": "affected",
              "version": "9.12.4.55"
            },
            {
              "status": "affected",
              "version": "9.12.4.56"
            },
            {
              "status": "affected",
              "version": "9.12.4.58"
            },
            {
              "status": "affected",
              "version": "9.12.4.62"
            },
            {
              "status": "affected",
              "version": "9.12.4.65"
            },
            {
              "status": "affected",
              "version": "9.12.4.67"
            },
            {
              "status": "affected",
              "version": "9.14.1"
            },
            {
              "status": "affected",
              "version": "9.14.1.10"
            },
            {
              "status": "affected",
              "version": "9.14.1.6"
            },
            {
              "status": "affected",
              "version": "9.14.1.15"
            },
            {
              "status": "affected",
              "version": "9.14.1.19"
            },
            {
              "status": "affected",
              "version": "9.14.1.30"
            },
            {
              "status": "affected",
              "version": "9.14.2"
            },
            {
              "status": "affected",
              "version": "9.14.2.4"
            },
            {
              "status": "affected",
              "version": "9.14.2.8"
            },
            {
              "status": "affected",
              "version": "9.14.2.13"
            },
            {
              "status": "affected",
              "version": "9.14.2.15"
            },
            {
              "status": "affected",
              "version": "9.14.3"
            },
            {
              "status": "affected",
              "version": "9.14.3.1"
            },
            {
              "status": "affected",
              "version": "9.14.3.9"
            },
            {
              "status": "affected",
              "version": "9.14.3.11"
            },
            {
              "status": "affected",
              "version": "9.14.3.13"
            },
            {
              "status": "affected",
              "version": "9.14.3.18"
            },
            {
              "status": "affected",
              "version": "9.14.3.15"
            },
            {
              "status": "affected",
              "version": "9.14.4"
            },
            {
              "status": "affected",
              "version": "9.14.4.6"
            },
            {
              "status": "affected",
              "version": "9.14.4.7"
            },
            {
              "status": "affected",
              "version": "9.14.4.12"
            },
            {
              "status": "affected",
              "version": "9.14.4.13"
            },
            {
              "status": "affected",
              "version": "9.14.4.14"
            },
            {
              "status": "affected",
              "version": "9.14.4.15"
            },
            {
              "status": "affected",
              "version": "9.14.4.17"
            },
            {
              "status": "affected",
              "version": "9.14.4.22"
            },
            {
              "status": "affected",
              "version": "9.14.4.23"
            },
            {
              "status": "affected",
              "version": "9.14.4.24"
            },
            {
              "status": "affected",
              "version": "9.15.1"
            },
            {
              "status": "affected",
              "version": "9.15.1.7"
            },
            {
              "status": "affected",
              "version": "9.15.1.10"
            },
            {
              "status": "affected",
              "version": "9.15.1.15"
            },
            {
              "status": "affected",
              "version": "9.15.1.16"
            },
            {
              "status": "affected",
              "version": "9.15.1.17"
            },
            {
              "status": "affected",
              "version": "9.15.1.1"
            },
            {
              "status": "affected",
              "version": "9.15.1.21"
            },
            {
              "status": "affected",
              "version": "9.16.1"
            },
            {
              "status": "affected",
              "version": "9.16.1.28"
            },
            {
              "status": "affected",
              "version": "9.16.2"
            },
            {
              "status": "affected",
              "version": "9.16.2.3"
            },
            {
              "status": "affected",
              "version": "9.16.2.7"
            },
            {
              "status": "affected",
              "version": "9.16.2.11"
            },
            {
              "status": "affected",
              "version": "9.16.2.13"
            },
            {
              "status": "affected",
              "version": "9.16.2.14"
            },
            {
              "status": "affected",
              "version": "9.16.3"
            },
            {
              "status": "affected",
              "version": "9.16.3.3"
            },
            {
              "status": "affected",
              "version": "9.16.3.14"
            },
            {
              "status": "affected",
              "version": "9.16.3.15"
            },
            {
              "status": "affected",
              "version": "9.16.3.19"
            },
            {
              "status": "affected",
              "version": "9.16.3.23"
            },
            {
              "status": "affected",
              "version": "9.16.4"
            },
            {
              "status": "affected",
              "version": "9.16.4.9"
            },
            {
              "status": "affected",
              "version": "9.16.4.14"
            },
            {
              "status": "affected",
              "version": "9.16.4.18"
            },
            {
              "status": "affected",
              "version": "9.16.4.19"
            },
            {
              "status": "affected",
              "version": "9.16.4.27"
            },
            {
              "status": "affected",
              "version": "9.16.4.38"
            },
            {
              "status": "affected",
              "version": "9.16.4.39"
            },
            {
              "status": "affected",
              "version": "9.16.4.42"
            },
            {
              "status": "affected",
              "version": "9.16.4.48"
            },
            {
              "status": "affected",
              "version": "9.16.4.55"
            },
            {
              "status": "affected",
              "version": "9.16.4.57"
            },
            {
              "status": "affected",
              "version": "9.16.4.61"
            },
            {
              "status": "affected",
              "version": "9.17.1"
            },
            {
              "status": "affected",
              "version": "9.17.1.7"
            },
            {
              "status": "affected",
              "version": "9.17.1.9"
            },
            {
              "status": "affected",
              "version": "9.17.1.10"
            },
            {
              "status": "affected",
              "version": "9.17.1.11"
            },
            {
              "status": "affected",
              "version": "9.17.1.13"
            },
            {
              "status": "affected",
              "version": "9.17.1.15"
            },
            {
              "status": "affected",
              "version": "9.17.1.20"
            },
            {
              "status": "affected",
              "version": "9.17.1.30"
            },
            {
              "status": "affected",
              "version": "9.17.1.33"
            },
            {
              "status": "affected",
              "version": "9.17.1.39"
            },
            {
              "status": "affected",
              "version": "9.18.1"
            },
            {
              "status": "affected",
              "version": "9.18.1.3"
            },
            {
              "status": "affected",
              "version": "9.18.2"
            },
            {
              "status": "affected",
              "version": "9.18.2.5"
            },
            {
              "status": "affected",
              "version": "9.18.2.7"
            },
            {
              "status": "affected",
              "version": "9.18.2.8"
            },
            {
              "status": "affected",
              "version": "9.18.3"
            },
            {
              "status": "affected",
              "version": "9.18.3.39"
            },
            {
              "status": "affected",
              "version": "9.18.3.46"
            },
            {
              "status": "affected",
              "version": "9.18.3.53"
            },
            {
              "status": "affected",
              "version": "9.18.3.55"
            },
            {
              "status": "affected",
              "version": "9.18.3.56"
            },
            {
              "status": "affected",
              "version": "9.18.4"
            },
            {
              "status": "affected",
              "version": "9.18.4.5"
            },
            {
              "status": "affected",
              "version": "9.18.4.8"
            },
            {
              "status": "affected",
              "version": "9.18.4.22"
            },
            {
              "status": "affected",
              "version": "9.18.4.24"
            },
            {
              "status": "affected",
              "version": "9.18.4.29"
            },
            {
              "status": "affected",
              "version": "9.19.1"
            },
            {
              "status": "affected",
              "version": "9.19.1.5"
            },
            {
              "status": "affected",
              "version": "9.19.1.9"
            },
            {
              "status": "affected",
              "version": "9.19.1.12"
            },
            {
              "status": "affected",
              "version": "9.19.1.18"
            },
            {
              "status": "affected",
              "version": "9.19.1.22"
            },
            {
              "status": "affected",
              "version": "9.19.1.24"
            },
            {
              "status": "affected",
              "version": "9.19.1.27"
            },
            {
              "status": "affected",
              "version": "9.19.1.28"
            },
            {
              "status": "affected",
              "version": "9.19.1.31"
            }
          ]
        },
        {
          "product": "Cisco Firepower Threat Defense Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.3"
            },
            {
              "status": "affected",
              "version": "6.2.3.1"
            },
            {
              "status": "affected",
              "version": "6.2.3.2"
            },
            {
              "status": "affected",
              "version": "6.2.3.3"
            },
            {
              "status": "affected",
              "version": "6.2.3.4"
            },
            {
              "status": "affected",
              "version": "6.2.3.5"
            },
            {
              "status": "affected",
              "version": "6.2.3.6"
            },
            {
              "status": "affected",
              "version": "6.2.3.7"
            },
            {
              "status": "affected",
              "version": "6.2.3.8"
            },
            {
              "status": "affected",
              "version": "6.2.3.10"
            },
            {
              "status": "affected",
              "version": "6.2.3.11"
            },
            {
              "status": "affected",
              "version": "6.2.3.9"
            },
            {
              "status": "affected",
              "version": "6.2.3.12"
            },
            {
              "status": "affected",
              "version": "6.2.3.13"
            },
            {
              "status": "affected",
              "version": "6.2.3.14"
            },
            {
              "status": "affected",
              "version": "6.2.3.15"
            },
            {
              "status": "affected",
              "version": "6.2.3.16"
            },
            {
              "status": "affected",
              "version": "6.2.3.17"
            },
            {
              "status": "affected",
              "version": "6.2.3.18"
            },
            {
              "status": "affected",
              "version": "6.6.0"
            },
            {
              "status": "affected",
              "version": "6.6.0.1"
            },
            {
              "status": "affected",
              "version": "6.6.1"
            },
            {
              "status": "affected",
              "version": "6.6.3"
            },
            {
              "status": "affected",
              "version": "6.6.4"
            },
            {
              "status": "affected",
              "version": "6.6.5"
            },
            {
              "status": "affected",
              "version": "6.6.5.1"
            },
            {
              "status": "affected",
              "version": "6.6.5.2"
            },
            {
              "status": "affected",
              "version": "6.6.7"
            },
            {
              "status": "affected",
              "version": "6.6.7.1"
            },
            {
              "status": "affected",
              "version": "6.6.7.2"
            },
            {
              "status": "affected",
              "version": "6.4.0"
            },
            {
              "status": "affected",
              "version": "6.4.0.1"
            },
            {
              "status": "affected",
              "version": "6.4.0.3"
            },
            {
              "status": "affected",
              "version": "6.4.0.2"
            },
            {
              "status": "affected",
              "version": "6.4.0.4"
            },
            {
              "status": "affected",
              "version": "6.4.0.5"
            },
            {
              "status": "affected",
              "version": "6.4.0.6"
            },
            {
              "status": "affected",
              "version": "6.4.0.7"
            },
            {
              "status": "affected",
              "version": "6.4.0.8"
            },
            {
              "status": "affected",
              "version": "6.4.0.9"
            },
            {
              "status": "affected",
              "version": "6.4.0.10"
            },
            {
              "status": "affected",
              "version": "6.4.0.11"
            },
            {
              "status": "affected",
              "version": "6.4.0.12"
            },
            {
              "status": "affected",
              "version": "6.4.0.13"
            },
            {
              "status": "affected",
              "version": "6.4.0.14"
            },
            {
              "status": "affected",
              "version": "6.4.0.15"
            },
            {
              "status": "affected",
              "version": "6.4.0.16"
            },
            {
              "status": "affected",
              "version": "6.4.0.17"
            },
            {
              "status": "affected",
              "version": "6.4.0.18"
            },
            {
              "status": "affected",
              "version": "6.7.0"
            },
            {
              "status": "affected",
              "version": "6.7.0.1"
            },
            {
              "status": "affected",
              "version": "6.7.0.2"
            },
            {
              "status": "affected",
              "version": "6.7.0.3"
            },
            {
              "status": "affected",
              "version": "7.0.0"
            },
            {
              "status": "affected",
              "version": "7.0.0.1"
            },
            {
              "status": "affected",
              "version": "7.0.1"
            },
            {
              "status": "affected",
              "version": "7.0.1.1"
            },
            {
              "status": "affected",
              "version": "7.0.2"
            },
            {
              "status": "affected",
              "version": "7.0.2.1"
            },
            {
              "status": "affected",
              "version": "7.0.3"
            },
            {
              "status": "affected",
              "version": "7.0.4"
            },
            {
              "status": "affected",
              "version": "7.0.5"
            },
            {
              "status": "affected",
              "version": "7.0.6"
            },
            {
              "status": "affected",
              "version": "7.0.6.1"
            },
            {
              "status": "affected",
              "version": "7.0.6.2"
            },
            {
              "status": "affected",
              "version": "7.1.0"
            },
            {
              "status": "affected",
              "version": "7.1.0.1"
            },
            {
              "status": "affected",
              "version": "7.1.0.2"
            },
            {
              "status": "affected",
              "version": "7.1.0.3"
            },
            {
              "status": "affected",
              "version": "7.2.0"
            },
            {
              "status": "affected",
              "version": "7.2.0.1"
            },
            {
              "status": "affected",
              "version": "7.2.1"
            },
            {
              "status": "affected",
              "version": "7.2.2"
            },
            {
              "status": "affected",
              "version": "7.2.3"
            },
            {
              "status": "affected",
              "version": "7.2.4"
            },
            {
              "status": "affected",
              "version": "7.2.4.1"
            },
            {
              "status": "affected",
              "version": "7.2.5"
            },
            {
              "status": "affected",
              "version": "7.2.5.1"
            },
            {
              "status": "affected",
              "version": "7.2.6"
            },
            {
              "status": "affected",
              "version": "7.2.7"
            },
            {
              "status": "affected",
              "version": "7.2.5.2"
            },
            {
              "status": "affected",
              "version": "7.2.8"
            },
            {
              "status": "affected",
              "version": "7.2.8.1"
            },
            {
              "status": "affected",
              "version": "7.3.0"
            },
            {
              "status": "affected",
              "version": "7.3.1"
            },
            {
              "status": "affected",
              "version": "7.3.1.1"
            },
            {
              "status": "affected",
              "version": "7.3.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the SSL VPN feature for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.\r\n\r This vulnerability is due to a logic error in memory management when the device is handling SSL VPN connections. An attacker could exploit this vulnerability by sending crafted SSL/TLS packets to the SSL VPN server of the affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-788",
              "description": "Access of Memory Location After End of Buffer",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-23T17:35:43.314Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-asaftd-webvpn-dos-hOnB9pH4",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-dos-hOnB9pH4"
        }
      ],
      "source": {
        "advisory": "cisco-sa-asaftd-webvpn-dos-hOnB9pH4",
        "defects": [
          "CSCwb00494",
          "CSCwj82247"
        ],
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20402",
    "datePublished": "2024-10-23T17:35:43.314Z",
    "dateReserved": "2023-11-08T15:08:07.660Z",
    "dateUpdated": "2024-10-24T16:16:53.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-20330 (GCVE-0-2024-20330)

Vulnerability from cvelistv5 – Published: 2024-10-23 17:08 – Updated: 2024-10-24 16:23
VLAI
Title
Cisco Firepower Threat Defense Software for Cisco Firepower 2100 Series TCP UDP Snort 2 and Snort 2 Denial of Service Vulnerability
Summary
A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause memory corruption, which could cause the Snort detection engine to restart unexpectedly. This vulnerability is due to improper memory management when the Snort detection engine processes specific TCP or UDP packets. An attacker could exploit this vulnerability by sending crafted TCP or UDP packets through a device that is inspecting traffic using the Snort detection engine. A successful exploit could allow the attacker to restart the Snort detection engine repeatedly, which could cause a denial of service (DoS) condition. The DoS condition impacts only the traffic through the device that is examined by the Snort detection engine. The device can still be managed over the network. Note: Once a memory block is corrupted, it cannot be cleared until the Cisco Firepower 2100 Series Appliance is manually reloaded. This means that the Snort detection engine could crash repeatedly, causing traffic that is processed by the Snort detection engine to be dropped until the device is manually reloaded.
Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-23 18:42 UTC
CWE
  • CWE-788 - Access of Memory Location After End of Buffer
Assigner
cisco CNA under the mitre root
CNA scorecard C 66/100 over 431 records in the last 180 days details
References
Impacted products
Vendor Product Version
Cisco Cisco Firepower Threat Defense Software Affected: 7.0.0
Affected: 7.0.0.1
Affected: 7.0.1
Affected: 7.1.0
Affected: 7.0.1.1
Affected: 7.1.0.1
Affected: 7.0.2
Affected: 7.2.0
Affected: 7.0.2.1
Affected: 7.0.3
Affected: 7.2.0.1
Affected: 7.0.4
Affected: 7.2.1
Affected: 7.0.5
Affected: 7.3.0
Affected: 7.2.2
Affected: 7.2.3
Affected: 7.3.1
Affected: 7.1.0.3
Affected: 7.2.4
Affected: 7.0.6
Affected: 7.2.5
Affected: 7.2.4.1
Affected: 7.3.1.1
Affected: 7.0.6.1
Affected: 7.2.5.1
Affected: 7.4.1
Affected: 7.2.6
Affected: 7.0.6.2
Affected: 7.4.1.1
Affected: 7.2.7
Affected: 7.2.5.2
Affected: 7.3.1.2
Affected: 7.2.8
Affected: 7.4.2
Affected: 7.2.8.1
Affected: 7.0.6.3
Create a notification for this product.
cisco firepower_threat_defense_software Affected: 7.0.0 , ≤ 7.0.6.3 (custom)
Affected: 7.1.0 , ≤ 7.1.0.3 (custom)
Affected: 7.2.0 , ≤ 7.2.8.1 (custom)
Affected: 7.3.0 , ≤ 7.3.1.2. (custom)
Affected: 7.4.1 , ≤ 7.4.2 (custom)
    cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firepower_threat_defense_software",
            "vendor": "cisco",
            "versions": [
              {
                "lessThanOrEqual": "7.0.6.3",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "7.1.0.3",
                "status": "affected",
                "version": "7.1.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "7.2.8.1",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "7.3.1.2.",
                "status": "affected",
                "version": "7.3.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "7.4.2",
                "status": "affected",
                "version": "7.4.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20330",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-23T18:42:48.320834Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-24T16:23:16.139Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Firepower Threat Defense Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.0"
            },
            {
              "status": "affected",
              "version": "7.0.0.1"
            },
            {
              "status": "affected",
              "version": "7.0.1"
            },
            {
              "status": "affected",
              "version": "7.1.0"
            },
            {
              "status": "affected",
              "version": "7.0.1.1"
            },
            {
              "status": "affected",
              "version": "7.1.0.1"
            },
            {
              "status": "affected",
              "version": "7.0.2"
            },
            {
              "status": "affected",
              "version": "7.2.0"
            },
            {
              "status": "affected",
              "version": "7.0.2.1"
            },
            {
              "status": "affected",
              "version": "7.0.3"
            },
            {
              "status": "affected",
              "version": "7.2.0.1"
            },
            {
              "status": "affected",
              "version": "7.0.4"
            },
            {
              "status": "affected",
              "version": "7.2.1"
            },
            {
              "status": "affected",
              "version": "7.0.5"
            },
            {
              "status": "affected",
              "version": "7.3.0"
            },
            {
              "status": "affected",
              "version": "7.2.2"
            },
            {
              "status": "affected",
              "version": "7.2.3"
            },
            {
              "status": "affected",
              "version": "7.3.1"
            },
            {
              "status": "affected",
              "version": "7.1.0.3"
            },
            {
              "status": "affected",
              "version": "7.2.4"
            },
            {
              "status": "affected",
              "version": "7.0.6"
            },
            {
              "status": "affected",
              "version": "7.2.5"
            },
            {
              "status": "affected",
              "version": "7.2.4.1"
            },
            {
              "status": "affected",
              "version": "7.3.1.1"
            },
            {
              "status": "affected",
              "version": "7.0.6.1"
            },
            {
              "status": "affected",
              "version": "7.2.5.1"
            },
            {
              "status": "affected",
              "version": "7.4.1"
            },
            {
              "status": "affected",
              "version": "7.2.6"
            },
            {
              "status": "affected",
              "version": "7.0.6.2"
            },
            {
              "status": "affected",
              "version": "7.4.1.1"
            },
            {
              "status": "affected",
              "version": "7.2.7"
            },
            {
              "status": "affected",
              "version": "7.2.5.2"
            },
            {
              "status": "affected",
              "version": "7.3.1.2"
            },
            {
              "status": "affected",
              "version": "7.2.8"
            },
            {
              "status": "affected",
              "version": "7.4.2"
            },
            {
              "status": "affected",
              "version": "7.2.8.1"
            },
            {
              "status": "affected",
              "version": "7.0.6.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause memory corruption, which could cause the Snort detection engine to restart unexpectedly.\r\n\r\nThis vulnerability is due to improper memory management when the Snort detection engine processes specific TCP or UDP packets. An attacker could exploit this vulnerability by sending crafted TCP or UDP packets through a device that is inspecting traffic using the Snort detection engine. A successful exploit could allow the attacker to restart the Snort detection engine repeatedly, which could cause a denial of service (DoS) condition. The DoS condition impacts only the traffic through the device that is examined by the Snort detection engine. The device can still be managed over the network.\r\nNote: Once a memory block is corrupted, it cannot be cleared until the Cisco Firepower 2100 Series Appliance is manually reloaded. This means that the Snort detection engine could crash repeatedly, causing traffic that is processed by the Snort detection engine to be dropped until the device is manually reloaded."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-788",
              "description": "Access of Memory Location After End of Buffer",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-23T17:08:44.510Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ftd2100-snort-dos-M9HuMt75",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd2100-snort-dos-M9HuMt75"
        },
        {
          "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-M446vbEO",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-M446vbEO"
        },
        {
          "name": "Cisco Event Response: October 2024 Semiannual Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication",
          "url": "https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75300"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ftd2100-snort-dos-M9HuMt75",
        "defects": [
          "CSCwk48488"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Firepower Threat Defense Software for Cisco Firepower 2100 Series TCP UDP Snort 2 and Snort 2 Denial of Service Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20330",
    "datePublished": "2024-10-23T17:08:44.510Z",
    "dateReserved": "2023-11-08T15:08:07.641Z",
    "dateUpdated": "2024-10-24T16:23:16.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list