« Volver al listado

CVE-2024-20526

Estado: AnalizadaMedia (5.3)—

A vulnerability in the SSH server of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition for the SSH server of an affected device.

This vulnerability is due to a logic error when an SSH session is established. An attacker could exploit this vulnerability by sending crafted SSH messages to an affected device. A successful exploit could allow the attacker to exhaust available SSH resources on the affected device so that new SSH connections to the device are denied, resulting in a DoS condition.

Leer descripción completaMostrar menos

Existing SSH connections to the device would continue to function normally. The device must be rebooted manually to recover. However, user traffic would not be impacted and could be managed using a remote application such as Cisco Adaptive Security Device Manager (ASDM).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Adaptive Security Appliance Software

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-20526",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-20526",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-23T18:36:06.989800Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@cisco.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "Cisco",
          "product": "Cisco Adaptive Security Appliance (ASA) Software",
          "versions": [
            {
              "status": "affected",
              "version": "9.16.4.67"
            },
            {
              "status": "affected",
              "version": "9.16.4.70"
            },
            {
              "status": "affected",
              "version": "9.18.4.40"
            },
            {
              "status": "affected",
              "version": "9.20.3"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*"
          ],
          "vendor": "cisco",
          "product": "adaptive_security_appliance_software",
          "versions": [
            {
              "status": "affected",
              "version": "9.16.4.67"
            },
            {
              "status": "affected",
              "version": "9.16.4.70"
            },
            {
              "status": "affected",
              "version": "9.18.4.40"
            },
            {
              "status": "affected",
              "version": "9.20.3"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-10-23T18:15:13.303",
  "references": [
    {
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssh-dos-eEDWu5RM",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the SSH server of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition for the SSH server of an affected device.\r\n\r This vulnerability is due to a logic error when an SSH session is established. An attacker could exploit this vulnerability by sending crafted SSH messages to an affected device. A successful exploit could allow the attacker to exhaust available SSH resources on the affected device so that new SSH connections to the device are denied, resulting in a DoS condition. Existing SSH connections to the device would continue to function normally. The device must be rebooted manually to recover. However, user traffic would not be impacted and could be managed using a remote application such as Cisco Adaptive Security Device Manager (ASDM)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el servidor SSH del software Cisco Adaptive Security Appliance (ASA) podría permitir que un atacante remoto no autenticado provoque una condición de denegación de servicio (DoS) para el servidor SSH de un dispositivo afectado. Esta vulnerabilidad se debe a un error lógico cuando se establece una sesión SSH. Un atacante podría aprovechar esta vulnerabilidad enviando mensajes SSH manipulados a un dispositivo afectado. Una explotación exitosa podría permitir que el atacante agote los recursos SSH disponibles en el dispositivo afectado para que se denieguen las nuevas conexiones SSH al dispositivo, lo que da como resultado una condición de DoS. Las conexiones SSH existentes al dispositivo continuarían funcionando normalmente. El dispositivo debe reiniciarse manualmente para recuperarse. Sin embargo, el tráfico de usuarios no se vería afectado y podría administrarse mediante una aplicación remota como Cisco Adaptive Security Device Manager (ASDM)."
    }
  ],
  "lastModified": "2026-06-17T07:07:30.563",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.67:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D87807D-4915-4785-A87C-CE3C1F825378"
            },
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.16.4.70:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "259825FC-469E-47AA-AD5C-E6C6F863A399"
            },
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.18.4.40:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95E7E362-4181-4D05-A391-634829CF3DA3"
            },
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B6648F1-B019-4A67-A1D6-9B8FD522E393"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}