Medium severity · published Dec 15, 2017
CVE-2017-12373
A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could allow an unauthenticated, remote attacker…
5.9
CVSS
12.8%
EPSS
No
On KEV
Description
A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could allow an unauthenticated, remote attacker to access sensitive information, aka a Return of Bleichenbacher's Oracle Threat (ROBOT) attack. An attacker could iteratively query a server running a vulnerable TLS stack implementation to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions. Cisco Bug IDs: CSCvg97652.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)12.8% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Adaptive Security Appliance 5505 Firmware · Cisco
All versions, or not specified · source: NVD
AS
Adaptive Security Appliance 5510 Firmware · Cisco
All versions, or not specified · source: NVD
AS
Adaptive Security Appliance 5520 Firmware · Cisco
All versions, or not specified · source: NVD
AS
Adaptive Security Appliance 5540 Firmware · Cisco
All versions, or not specified · source: NVD
AS
Adaptive Security Appliance 5550 Firmware · Cisco
All versions, or not specified · source: NVD
Affected product
AS
Adaptive Security Appliance 5505 Firmware
Cisco
More from Adaptive Security Appliance 5505 Firmware
5.9
CVE-2017-17428
Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding…