VULNERABILITY INTELLIGENCE

CVE-2015-0675

CVSS score8.3 HIGH
EPSS probability0.96%
CISA KEVNot currently listed
Published2015-04-13
Last modified2026-06-17
CVSS vectorAV:A/AC:L/Au:N/C:C/I:C/A:C

Description

The failover ipsec implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1 before 9.1(6), 9.2 before 9.2(3.3), and 9.3 before 9.3(3) does not properly validate failover communication messages, which allows remote attackers to reconfigure an ASA device, and consequently obtain administrative control, by sending crafted UDP packets over the local network to the failover interface, aka Bug ID CSCur21069.

Weakness classification

  • CWE-284: Improper Access Control

Primary references