Vulnerability in Cisco Adaptive Security Appliance Software
CVE-2015-4550
The Cavium cryptographic-module firmware on Cisco Adaptive Security Appliance (ASA) devices with software 9.3(3) and 9.4(1.1) does not verify the AES-GCM Integrity Check Value (ICV) octets, which makes it easier for man-in-the-middle attackers to spoof IPSec and IKEv2 traffic by modifying packet data, aka Bug ID CSCuu66218.
Vulnerability class: POODLE (CVE-2014-3566)
EPSS: 0.013 (67.3th percentile) — read the EPSS interpretation.
Affected products
- Cisco Adaptive_security_appliance_software — versions 9.3\(3\), 9.4\(1.1\)
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_CISCO, vendor-advisory, Vendor Advisory)