Experts warn that threat actors continue to exploit the CVE-2018-0296 flaw to target Cisco ASA and Firepower Appliance. The vulnerability could be exploited by a remote,
“A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (
The root cause of the issue is the lack of proper input validation of the HTTP URL, it could be exploited by an attacker by sending a specially-crafted HTTP request to a vulnerable device.
The vulnerability affects the following Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products:
The vulnerability was patched more than a year ago, in early June 2018, since its disclosure many
The vulnerability was initially classified as high severity, but recently Cisco rated it as critical severity.
Now experts at Cisco Talos are warning of a spike in
“Cisco Talos has recently noticed a sudden spike in exploitation attempts against a specific vulnerability in our Cisco Adaptive Security Appliance (ASA) and Firepower Appliance. The vulnerability, CVE-2018-0296, is a
“This isn’t a new vulnerability, but as exploitation continues to increase, customers need to be aware of the risk of both a denial-of-service or
Admins could determine if they are vulnerable by running the following commands:
show asp table socket | include SSL|DTLS
If the command shows any listening sockets, the device is potentially at risk. To determine if the vulnerable process is running the admins could run the following command:
show processes | include Unicorn
If the process is shown as running, the likelihood of a vulnerability existing is elevated and the administrator should validate the running version of
Cisco already released security updates to address the issue.
(SecurityAffairs – Cisco ASA, CVE-2018-0296)