A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could all…

published 2017-12-15 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-3946

cvss: 5.9; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 12.8%; EPSS 12.8% chance of exploitation in 30 days, percentile 96%
public exploits: 1; Metasploit

A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could allow an unauthenticated, remote attacker to access sensitive information, aka a Return of Bleichenbacher's Oracle Threat (ROBOT) attack. An attacker could iteratively query a server running a vulnerable TLS stack implementation to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions. Cisco Bug IDs: CSCvg97652.

Timeline

2009-06-17 First public exploit (Metasploit auxiliary/scanner/ssl/bleichenbacher_oracle)
2017-12-15 Published

Exploit prediction

12.80% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit auxiliary/scanner/ssl/bleichenbacher_oracle Scanner for Bleichenbacher Oracle in RSA PKCS #1 v1.5 metasploit auxiliary, normal rank, 2009-06-17

CVSS scores

assigned by	version	score	vector
NVD	3.0	5.9	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

n/a Cisco legacy ASA 5500 products TLS protocol implementation

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-203 Observable Discrepancy

References

tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher
issue-tracking, mitigation, vendor-advisory
securityfocus.com /bid/102170
vdb-entry, third-party-advisory

Sources

CVE List CVE-2017-12373
NVD CVE-2017-12373

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary