Vulnerability record · CVE-2020-3188 · published 6 May 2020
CVE-2020-3188: Cisco secure firewall threat defense insufficient session expiration vulnerability
Cisco · Secure Firewall Threat Defense
A vulnerability in how Cisco Firepower Threat Defense (FTD) Software handles session timeouts for management connections could allow an unauthenticated, remote attacker to cause a buildup of remote management connections to an affected device, which could result in a denial of service (DoS) condition. The vulnerability exists because the default session timeout period for specific to-the-box remote management connections is too long. An attacker could exploit this vulnerability by sending a large and sustained number of crafted remote management connections to an affected device, resulting in a buildup of those connections over time. A successful exploit could allow the attacker to cause the remote management interface or Cisco Firepower Device Manager (FDM) to stop responding and cause other management functions to go offline, resulting in a DoS condition. The user traffic that is flowing through the device would not be affected, and the DoS condition would be isolated to remote management only.
Description
A vulnerability in how Cisco Firepower Threat Defense (FTD) Software handles session timeouts for management connections could allow an unauthenticated, remote attacker to cause a buildup of remote management connections to an affected device, which could result in a denial of service (DoS) condition. The vulnerability exists because the default session timeout period for specific to-the-box remote management connections is too long. An attacker could exploit this vulnerability by sending a large and sustained number of crafted remote management connections to an affected device, resulting in a buildup of those connections over time. A successful exploit could allow the attacker to cause the remote management interface or Cisco Firepower Device Manager (FDM) to stop responding and cause other management functions to go offline, resulting in a DoS condition. The user traffic that is flowing through the device would not be affected, and the DoS condition would be isolated to remote management only.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
13 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
Asa 5505 Firmware Cisco
Asa 5510 Firmware Cisco
Asa 5512 X Firmware Cisco
Asa 5515 X Firmware Cisco
Asa 5520 Firmware Cisco
Asa 5525 X Firmware Cisco
Asa 5540 Firmware Cisco
Asa 5545 X Firmware Cisco
Asa 5550 Firmware Cisco
Asa 5555 X Firmware Cisco
Asa 5580 Firmware Cisco
Asa 5585 X Firmware Cisco
Secure Firewall Threat Defense Cisco
References
Track CVE-2020-3188 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-3188), CISA KEV, FIRST EPSS (scores of 2026-10-09). This page is refreshed as NVD updates the record.
