CVE-2019-15256: Cisco Adaptive Security Appliance Software denial of service (CVSS 8.6)

Description

A vulnerability in the Internet Key Exchange version 1 (IKEv1) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper management of system memory. An attacker could exploit this vulnerability by sending malicious IKEv1 traffic to an affected device. The attacker does not need valid credentials to authenticate the VPN session, nor does the attacker's source address need to match a peer statement in the crypto map applied to the ingress interface of the affected device. An exploit could allow the attacker to exhaust system memory resources, leading to a reload of an affected device.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected products

Cisco Adaptive Security Appliance Software≥ 9.7 < 9.8.4.10 · ≥ 9.10 < 9.10.1.30 · ≥ 9.12 < 9.12.2.5 · ≥ 9.9 < 9.9.2.47

Cisco Secure Firewall Threat Defense≥ 6.2.0 < 6.2.3.11 · ≥ 6.3.0 < 6.3.0.2

Cisco ASA 5505 Firmware201.4\(1.21\) · 9.9\(2.4\)

Cisco ASA 5510 Firmware201.4\(1.21\) · 9.9\(2.4\)

Cisco ASA 5512-x Firmware201.4\(1.21\) · 9.9\(2.4\)

Cisco ASA 5515-x Firmware201.4\(1.21\) · 9.9\(2.4\)

Cisco ASA 5520 Firmware201.4\(1.21\) · 9.9\(2.4\)

Cisco ASA 5525-x Firmware201.4\(1.21\) · 9.9\(2.4\)

Cisco ASA 5540 Firmware201.4\(1.21\) · 9.9\(2.4\)

Cisco ASA 5545-x Firmware201.4\(1.21\) · 9.9\(2.4\)

Cisco ASA 5550 Firmware201.4\(1.21\) · 9.9\(2.4\)

Cisco ASA 5555-x Firmware201.4\(1.21\) · 9.9\(2.4\)

Cisco ASA 5580 Firmware201.4\(1.21\) · 9.9\(2.4\)

Remediation

Fixed in

Cisco Adaptive Security Appliance Software≥ 9.8.4.10

Cisco Secure Firewall Threat Defense≥ 6.2.3.11

Patch & vendor advisories

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-asa-ftd-ikev1-dos

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-asa-ftd-ikev1-dosVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2019-15256 being actively exploited?

CVE-2019-15256 is not in the CISA KEV catalog. Its EPSS exploit probability is 1.98%.

How severe is CVE-2019-15256?

CVE-2019-15256 has a CVSS 3.1 base score of 8.6, rated high. EPSS estimates a 1.98% probability of exploitation.

Which products are affected by CVE-2019-15256?

Affected products include Cisco Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense, Cisco ASA 5505 Firmware, Cisco ASA 5510 Firmware, Cisco ASA 5512-x Firmware, and 8 more.

How do I fix CVE-2019-15256?

Upgrade affected software to a fixed version, for example Cisco Adaptive Security Appliance Software 9.8.4.10, Cisco Secure Firewall Threat Defense 6.2.3.11 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2019-15256 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo