Cisco Secure Firewall flaw lets attackers reboot devices without logging in
- Affected
- ASA Software
9.24and earlier and Threat Defense Software10.1and earlier before their fixed releases, when the VPN uses secondary authentication. All versions and fixes
- Vendor
- Cisco
A flaw in the remote access VPN of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense Software lets an unauthenticated, remote attacker make the device reload. Cisco says it became aware of exploitation in October, and CISA added the flaw to KEV on Oct 29. Only devices whose VPN login is reachable and that use secondary authentication in a tunnel group are exposed. Cisco has released fixed software for each branch in its advisory.
Cisco traces the flaw to logic errors when secondary authentication is configured on a tunnel group, the connection profile a VPN user signs in to. An attacker sends a crafted request while connecting to the remote access VPN, and the device reloads. Cisco notes that an attacker doesn’t need a successful VPN login to reach the faulty code. CISA describes it as an unchecked return value that leads to a null pointer dereference.
A device is exposed when it runs an affected release, has the VPN enabled on at least one interface and uses secondary authentication in the tunnel group scope. With tunnel-group-list enable set, Cisco says to check every tunnel group, including the default group, DefaultWEBVPNGroup, for secondary-authentication-server-group. Turning the list off doesn’t help when the default group uses secondary authentication. Cisco’s cloud-delivered firewall, Secure Firewall Management Center and Secure Access aren’t affected.
Cisco published its advisory on Oct 28 and says its product security team learned of exploitation in October. It hasn’t said who exploited the flaw, when the attacks began or how many devices were hit. The flaw was found while resolving a case with Cisco’s Technical Assistance Center. Cisco rates it high, with a CVSS 3.1 score of 8.6, and lists no workaround, only a mitigation that removes secondary authentication or the group list.
- Vendor
- Cisco
What to do
5 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| Cisco Secure Firewall ASA Software 9.16 and earlier | Releases before the fix | The fixed 9.16 release in Cisco’s advisory |
| Cisco Secure Firewall ASA Software 9.18 | Releases before the fix | The fixed 9.18 release in Cisco’s advisory |
| Cisco Secure Firewall ASA Software 9.20 | Releases before the fix | The fixed 9.20 release in Cisco’s advisory |
| Cisco Secure Firewall ASA Software 9.22 | Releases before the fix | The fixed 9.22 release in Cisco’s advisory |
| Cisco Secure Firewall ASA Software 9.23 | Releases before the fix | The fixed 9.23 release in Cisco’s advisory |
| Cisco Secure Firewall ASA Software 9.24 | Releases before the fixes | Either fixed 9.24 release in Cisco’s advisory |
| Cisco Secure FTD Software 7.0 and earlier | Releases before 7.0.11 | 7.0.11 or later |
| Cisco Secure FTD Software 7.2 | 7.2 before 7.2.13 | 7.2.13 or later |
| Cisco Secure FTD Software 7.4 | 7.4 before 7.4.9 | 7.4.9 or later |
| Cisco Secure FTD Software 7.6 | 7.6 before 7.6.7 | 7.6.7 or later |
| Cisco Secure FTD Software 7.7 | 7.7 before 7.7.14 | 7.7.14 or later |
| Cisco Secure FTD Software 10.0 | 10.0 before 10.0.3 | 10.0.3 or later |
| Cisco Secure FTD Software 10.1 | 10.1 before 10.1.1 | 10.1.1 or later |
- Product
- Cisco Secure Firewall ASA Software 9.16 and earlier
- Affected
- Releases before the fix
- Fixed
- The fixed
9.16release in Cisco’s advisory
- Product
- Cisco Secure Firewall ASA Software 9.18
- Affected
- Releases before the fix
- Fixed
- The fixed
9.18release in Cisco’s advisory
- Product
- Cisco Secure Firewall ASA Software 9.20
- Affected
- Releases before the fix
- Fixed
- The fixed
9.20release in Cisco’s advisory
- Product
- Cisco Secure Firewall ASA Software 9.22
- Affected
- Releases before the fix
- Fixed
- The fixed
9.22release in Cisco’s advisory
- Product
- Cisco Secure Firewall ASA Software 9.23
- Affected
- Releases before the fix
- Fixed
- The fixed
9.23release in Cisco’s advisory
- Product
- Cisco Secure Firewall ASA Software 9.24
- Affected
- Releases before the fixes
- Fixed
- Either fixed
9.24release in Cisco’s advisory
- Product
- Cisco Secure FTD Software 7.0 and earlier
- Affected
- Releases before
7.0.11 - Fixed
7.0.11or later
- Product
- Cisco Secure FTD Software 7.2
- Affected
7.2before7.2.13- Fixed
7.2.13or later
- Product
- Cisco Secure FTD Software 7.4
- Affected
7.4before7.4.9- Fixed
7.4.9or later
- Product
- Cisco Secure FTD Software 7.6
- Affected
7.6before7.6.7- Fixed
7.6.7or later
- Product
- Cisco Secure FTD Software 7.7
- Affected
7.7before7.7.14- Fixed
7.7.14or later
- Product
- Cisco Secure FTD Software 10.0
- Affected
10.0before10.0.3- Fixed
10.0.3or later
- Product
- Cisco Secure FTD Software 10.1
- Affected
10.1before10.1.1- Fixed
10.1.1or later
Timeline
- Oct 28Cisco publishes its advisory and says it knows of exploitation.
- Oct 29CISA adds the flaw to KEV.
Sources
- Cisco advisoryPrimary source sec.cloudapps.cisco.com