Critical · published January 30, 2018
CVSS calls it critical at 10.0. It sits in the 99.7th percentile for exploit probability.
🚨 An unauthenticated attacker can send crafted XML packets to reload your Cisco ASA device or execute remote code! 🔥 Think of it like a sneaky prankster slipping a faulty invitation into an exclusive event's guest list — once inside, chaos can ensue, and the whole system could crash or be taken over! An attacker with a clever approach can seize full control of your device, potentially leading to unauthorized access to sensitive data or disrupting your entire service. This isn't just about a simple reboot; it could mean a serious security breach and operational downtime!
Think of it like a sneaky prankster slipping a faulty invitation into an exclusive event's guest list — once inside, chaos can ensue, and the whole system could crash or be taken over! This vulnerability arises from a double-free memory error in the SSL VPN functionality of Cisco ASA when the webvpn feature is enabled. Exploiting it involves sending multiple malicious XML packets to the system's webvpn-configured interface, enabling the attacker to execute arbitrary code.
An attacker with a clever approach can seize full control of your device, potentially leading to unauthorized access to sensitive data or disrupting your entire service. This isn't just about a simple reboot; it could mean a serious security breach and operational downtime! Immediately upgrade to the latest Cisco ASA software version to patch this vulnerability. Additionally, review your firewall configurations to minimize exposure and ensure that only trusted connections are allowed to access your webvpn interface. Regularly monitor logs for any suspicious activity as well! You've got this! Stay vigilant and follow these steps to keep your network secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| cisco/adaptive_security_appliance_software | < 9.1.7.23 | 9.1.7.23 |
| cisco/adaptive_security_appliance_software | ≥ 9.2.0, < 9.2.4.27 | 9.2.4.27 |
| cisco/adaptive_security_appliance_software | ≥ 9.3.0, < 9.4.4.16 | 9.4.4.16 |
| cisco/adaptive_security_appliance_software | ≥ 9.5.0, < 9.6.4.3 | 9.6.4.3 |
| cisco/adaptive_security_appliance_software | ≥ 9.7.0, < 9.7.1.21 | 9.7.1.21 |
| cisco/adaptive_security_appliance_software | ≥ 9.8.0, < 9.8.2.20 | 9.8.2.20 |
| cisco/adaptive_security_appliance_software | ≥ 9.9.0, < 9.9.1.2 | 9.9.1.2 |
| cisco/secure_firewall_threat_defense | all versions | — |
| cisco/secure_firewall_threat_defense | all versions | — |
| cisco/secure_firewall_threat_defense | all versions | — |
| cisco/secure_firewall_threat_defense | all versions | — |
| cisco/secure_firewall_threat_defense | all versions | — |
| cisco/secure_firewall_threat_defense | all versions | — |