Cisco Adaptive Security Appliance RADIUS Change of Authorization Message Replay Vulnerability

A vulnerability in RADIUS Change of Authorization (CoA) messages of the Identity Firewall (IDFW) feature of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to modify the contents of the IDFW user cache.

The vulnerability is due to insufficient validation of received RADIUS CoA messages. An attacker could exploit this vulnerability by replaying crafted RAIDUS CoA messages. An exploit could allow the attacker to modify the IDFW user cache of the ASA.

Cisco has confirmed the vulnerability in a security notice; however, software updates are not available.

To exploit this vulnerability, an attacker would likely require access to trusted, internal networks to replay crafted RADIUS messages. This access requirement reduces the likelihood of a successful exploit.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.