Description
A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could allow an unauthenticated, remote attacker to access sensitive information, aka a Return of Bleichenbacher's Oracle Threat (ROBOT) attack. An attacker could iteratively query a server running a vulnerable TLS stack implementation to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions. Cisco Bug IDs: CSCvg97652.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/102170
Issue Tracking, Mitigation, Vendor Advisory x_refsource_confirm
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher
Scores
CVSS v3
5.9
EPSS
0.1280
EPSS Percentile
95.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-200
CWE-203
Status
published
Products (6)
cisco/adaptive_security_appliance_5505_firmware
cisco/adaptive_security_appliance_5510_firmware
cisco/adaptive_security_appliance_5520_firmware
cisco/adaptive_security_appliance_5540_firmware
cisco/adaptive_security_appliance_5550_firmware
n/a/Cisco legacy ASA 5500 products TLS protocol implementation
Cisco legacy ASA 5500 products TLS protocol implementation
Published
Dec 15, 2017
Tracked Since
Feb 18, 2026