CVE-2020-3564
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
A vulnerability in the FTP inspection engine of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to bypass FTP inspection. The issue is due to ineffective flow tracking of FTP traffic. An attacker could exploit this by sending crafted FTP traffic through the device, allowing bypass of inspection and successful FTP connections.
Risk Assessment
The organization may face uncontrolled FTP traffic, potentially leading to security policy violations and possible introduction of malicious traffic into the network.
Recommendation
It is recommended to update Cisco ASA and FTD software to patched versions and follow vendor guidance regarding this vulnerability.
Original NVD description (English source)
A vulnerability in the FTP inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass FTP inspection. The vulnerability is due to ineffective flow tracking of FTP traffic. An attacker could exploit this vulnerability by sending crafted FTP traffic through an affected device. A successful exploit could allow the attacker to bypass FTP inspection and successfully complete FTP connections.