CVE-2020-3308

medium Cisco
CVSS v3 Base Score
4.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
EPSS Score
0.6%
Exploitation probability in 30 days
Top 54% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Confidentiality
None
Integrity
High
Availability
None
Published: May 6, 2020 (2314 days ago)
Last Modified: August 11, 2026
Vendor: Cisco
Source: NVD

Description

A vulnerability in the Image Signature Verification feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by crafting an unsigned software patch to bypass signature checks and loading it on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image.

CWE

CWE-347

Affected Products

cisco secure firewall threat defensecisco secure firewall management center

References

🔗 tools.cisco.com 🔗 tools.cisco.com