CVE-2020-3548 (CNNVD-202009-077)
中文标题:
Cisco AsyncOS 安全漏洞
英文标题:
Cisco Email Security Appliance Denial Of Service Vulnerability
漏洞描述
中文描述:
Cisco AsyncOS是美国思科（Cisco）公司的一款应用于思科设备的操作系统。 Cisco AsyncOS 存在安全漏洞，该漏洞源于TLS流量的处理效率低，攻击者可以通过向受影响的设备发送特制的TLS数据包来利用此漏洞，受影响的设备仍将可操作，但是响应时间和整体性能可能会下降。
英文描述:
A vulnerability in the Transport Layer Security (TLS) protocol implementation of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause high CPU usage on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to inefficient processing of incoming TLS traffic. An attacker could exploit this vulnerability by sending a series of crafted TLS packets to an affected device. A successful exploit could allow the attacker to trigger a prolonged state of high CPU utilization. The affected device would still be operative, but response time and overall performance may be degraded.There are no workarounds that address this vulnerability.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco Secure Email | N/A | - | - |
cpe:2.3:a:cisco:cisco_secure_email:n_a:*:*:*:*:*:*:*
|
| cisco | email_security_appliance | * | - | - |
cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/RL:X/RC:X/E:X
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2020-3548 |
2025-11-11 15:20:37 | 2025-11-11 07:36:19 |
| NVD | nvd_CVE-2020-3548 |
2025-11-11 14:57:13 | 2025-11-11 07:44:44 |
| CNNVD | cnnvd_CNNVD-202009-077 |
2025-11-11 15:10:29 | 2025-11-11 07:56:25 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202009-077
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']