CVE-2015-0675

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 13-04-2015 03:59

Last modified: - 26-05-2022 05:11

Total changes: - 2

Description

The failover ipsec implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1 before 9.1(6), 9.2 before 9.2(3.3), and 9.3 before 9.3(3) does not properly validate failover communication messages, which allows remote attackers to reconfigure an ASA device, and consequently obtain administrative control, by sending crafted UDP packets over the local network to the failover interface, aka Bug ID CSCur21069.

Common Vulnerability Scoring System (CVSS)

AV:A/AC:L/Au:N/C:C/I:C/A:C

Low

Attack complexity

Adjacent

Attack vector

High

Availability

High

Confidentiality

High

Integrity

Privileges required

Scope

User interaction

8.3

Base score

6.5

10.0

Exploitability score

Impact score

Verification logic

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.3.2

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.1.1.4

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.1.4

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.2.2.7

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.1.5.21

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.1.3

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.1.2

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.2.3

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.3.1.1

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.1.1

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.1.4.5

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.1.5

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.2.1

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.2.2

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.2.2.4

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.1.3.2

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.1.5.10

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.1.5.12

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.3.2.2

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.1.2.8

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.3.1

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.1.5.15

vendor=cisco AND product=adaptive_security_appliance_software AND version=9.2.2.8

Reference

20150408 Multiple Vulnerabilities in Cisco ASA Software-Vendor Advisory
1032045-

Keywords

CVE-2015-0675

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2015-0675

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures