Medium · published September 25, 2025
CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
⚠️ A crafty little vulnerability lets remote attackers peek behind the curtain! With just a few crafted HTTP requests, they could access restricted VPN endpoints without a password. 🔍 Think of it like a bouncer at a fancy club accepting fake IDs. Instead of turning away unauthorized guests, the system is letting them waltz right in, bypassing security entirely. If exploited, an attacker could gain access to sensitive VPN endpoints, potentially leading to unauthorized data access or even a denial of service, causing the device to unexpectedly reload. This could leave your network vulnerable and disrupt essential services, which is absolutely devastating! 🔥
Think of it like a bouncer at a fancy club accepting fake IDs. Instead of turning away unauthorized guests, the system is letting them waltz right in, bypassing security entirely. This vulnerability arises from improper validation of user-supplied input in HTTP(S) requests to the Cisco Secure ASA and FTD Software, allowing unauthenticated attackers to access restricted URLs that should otherwise require authentication.
If exploited, an attacker could gain access to sensitive VPN endpoints, potentially leading to unauthorized data access or even a denial of service, causing the device to unexpectedly reload. This could leave your network vulnerable and disrupt essential services, which is absolutely devastating! 🔥 Upgrade to the fixed software versions listed in the advisory immediately. Regularly audit your network configurations and ensure your firewall settings are correctly set to mitigate such vulnerabilities. Stay vigilant! 🛡️ You’ve got this! Take these steps, and you'll be one step closer to thwarting the bad guys! 🚀
| Product | Versions | Fixed in |
|---|---|---|
| cisco/adaptive_security_appliance_software | ≥ 9.12, < 9.12.4.72 | 9.12.4.72 |
| cisco/adaptive_security_appliance_software | ≥ 9.14, < 9.14.4.28 | 9.14.4.28 |
| cisco/adaptive_security_appliance_software | ≥ 9.16, < 9.16.4.85 | 9.16.4.85 |
| cisco/adaptive_security_appliance_software | ≥ 9.17.0, < 9.18.4.67 | 9.18.4.67 |
| cisco/adaptive_security_appliance_software | ≥ 9.19, < 9.20.4.10 | 9.20.4.10 |
| cisco/adaptive_security_appliance_software | ≥ 9.22, < 9.22.2.14 | 9.22.2.14 |
| cisco/adaptive_security_appliance_software | ≥ 9.23, < 9.23.1.19 | 9.23.1.19 |
| cisco/secure_firewall_threat_defense | ≥ 7.0.0, < 7.0.8.1 | 7.0.8.1 |
| cisco/secure_firewall_threat_defense | ≥ 7.1.0, < 7.2.10.2 | 7.2.10.2 |
| cisco/secure_firewall_threat_defense | ≥ 7.3.0, < 7.4.2.4 | 7.4.2.4 |
| cisco/secure_firewall_threat_defense | ≥ 7.6.0, < 7.6.2.1 | 7.6.2.1 |
| cisco/secure_firewall_threat_defense | ≥ 7.7.0, < 7.7.10.1 | 7.7.10.1 |