Lucene search

K
ciscoCiscoCISCO-SA-ASAFTD-OGSNSG-ACLBYP-3XB8Q6JX
HistoryMay 22, 2024 - 4:00 p.m.

Cisco Adaptive Security Appliance and Firepower Threat Defense Software Inactive-to-Active ACL Bypass Vulnerability

2024-05-2216:00:00
tools.cisco.com
6
cisco
asa
ftd
acl
vulnerability
logic error
remote attacker
access control list
ipv4
ipv6
interface
software update
security advisory

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

A vulnerability in the activation of an access control list (ACL) on Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL on an affected device.

This vulnerability is due to a logic error that occurs when an ACL changes from inactive to active in the running configuration of an affected device. An attacker could exploit this vulnerability by sending traffic through the affected device that should be denied by the configured ACL. The reverse condition is also trueβ€”traffic that should be permitted could be denied by the configured ACL. A successful exploit could allow the attacker to bypass configured ACL protections on the affected device, allowing the attacker to access trusted networks that the device might be protecting.

Note: This vulnerability applies to both IPv4 and IPv6 traffic as well as dual-stack ACL configurations in which both IPv4 and IPv6 ACLs are configured on an interface.

Cisco has released software updates that address this vulnerability. There is a workaround that addresses this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ogsnsg-aclbyp-3XB8q6jX [β€œhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ogsnsg-aclbyp-3XB8q6jX”]

This advisory is part of the May 2024 release of the Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: May 2024 Semiannual Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication [β€œhttps://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75298”].

Affected configurations

Vulners
Node
ciscoadaptive_security_appliance_softwareMatch9.19
OR
ciscoadaptive_security_appliance_softwareMatch9.20
OR
ciscofirepower_2100Matchany
OR
ciscofirepower_1000Matchany
OR
ciscoindustrial_security_appliances_3000Matchany
OR
ciscofirepower_9000Matchany
OR
ciscofirepower_4100Matchany
OR
ciscoadaptive_security_virtual_applianceMatchany
OR
ciscosecure_pix_firewallMatchany
OR
ciscosecure_pix_firewallMatchany
OR
ciscofirepower_threat_defense_softwareMatch7.3
OR
ciscofirepower_threat_defense_softwareMatch7.4
OR
ciscofirepower_2100Matchany
OR
ciscofirepower_1000Matchany
OR
ciscoindustrial_security_appliances_3000Matchany
OR
ciscofirepower_9000Matchany
OR
ciscofirepower_4100Matchany
OR
ciscofirepower_threat_defense_virtualMatchany
OR
ciscosecure_pix_firewallMatchany
OR
ciscosecure_pix_firewallMatchany
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1.5
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1.9
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1.12
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1.18
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1.22
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1.24
OR
ciscoadaptive_security_appliance_softwareMatch9.20.1
OR
ciscoadaptive_security_appliance_softwareMatch9.20.1.5
OR
ciscoadaptive_security_appliance_softwareMatch2100 Series
OR
ciscoadaptive_security_appliance_softwareMatch1000 Series
OR
ciscoadaptive_security_appliance_softwareMatch3000 Series Industrial Security Appliances (ISA)
OR
ciscoadaptive_security_appliance_softwareMatch9000 Series
OR
ciscoadaptive_security_appliance_softwareMatch4100 Series
OR
ciscoadaptive_security_virtual_applianceMatchany
OR
ciscoadaptive_security_appliance_softwareMatch3100 Series
OR
ciscoadaptive_security_appliance_softwareMatch4200 Series
OR
ciscofirepower_threat_defense_softwareMatch7.3.0
OR
ciscofirepower_threat_defense_softwareMatch7.3.1
OR
ciscofirepower_threat_defense_softwareMatch7.3.1.1
OR
ciscofirepower_threat_defense_softwareMatch7.3.1.2
OR
ciscofirepower_threat_defense_softwareMatch7.4.0
OR
ciscofirepower_threat_defense_softwareMatch2100 Series
OR
ciscofirepower_threat_defense_softwareMatch1000 Series
OR
ciscofirepower_threat_defense_softwareMatch3000 Series Industrial Security Appliances (ISA)
OR
ciscofirepower_threat_defense_softwareMatch9000 Series
OR
ciscofirepower_threat_defense_softwareMatch4100 Series
OR
ciscofirepower_threat_defense_virtualMatchany
OR
ciscofirepower_threat_defense_softwareMatch3100 Series
OR
ciscofirepower_threat_defense_softwareMatch4200 Series
OR
ciscoadaptive_security_appliance_softwareMatch2100 Series
OR
ciscoadaptive_security_appliance_softwareMatch1000 Series
OR
ciscoadaptive_security_appliance_softwareMatch3000 Series Industrial Security Appliances (ISA)
OR
ciscoadaptive_security_appliance_softwareMatch9000 Series
OR
ciscoadaptive_security_appliance_softwareMatch4100 Series
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)
OR
ciscoadaptive_security_appliance_softwareMatch3100 Series
OR
ciscoadaptive_security_appliance_softwareMatch2100 Series
OR
ciscoadaptive_security_appliance_softwareMatch1000 Series
OR
ciscoadaptive_security_appliance_softwareMatch3000 Series Industrial Security Appliances (ISA)
OR
ciscoadaptive_security_appliance_softwareMatch9000 Series
OR
ciscoadaptive_security_appliance_softwareMatch4100 Series
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1.5 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)
OR
ciscoadaptive_security_appliance_softwareMatch3100 Series
OR
ciscoadaptive_security_appliance_softwareMatch2100 Series
OR
ciscoadaptive_security_appliance_softwareMatch1000 Series
OR
ciscoadaptive_security_appliance_softwareMatch3000 Series Industrial Security Appliances (ISA)
OR
ciscoadaptive_security_appliance_softwareMatch9000 Series
OR
ciscoadaptive_security_appliance_softwareMatch4100 Series
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1.9 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)
OR
ciscoadaptive_security_appliance_softwareMatch3100 Series
OR
ciscoadaptive_security_appliance_softwareMatch2100 Series
OR
ciscoadaptive_security_appliance_softwareMatch1000 Series
OR
ciscoadaptive_security_appliance_softwareMatch3000 Series Industrial Security Appliances (ISA)
OR
ciscoadaptive_security_appliance_softwareMatch9000 Series
OR
ciscoadaptive_security_appliance_softwareMatch4100 Series
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1.12 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)
OR
ciscoadaptive_security_appliance_softwareMatch3100 Series
OR
ciscoadaptive_security_appliance_softwareMatch2100 Series
OR
ciscoadaptive_security_appliance_softwareMatch1000 Series
OR
ciscoadaptive_security_appliance_softwareMatch3000 Series Industrial Security Appliances (ISA)
OR
ciscoadaptive_security_appliance_softwareMatch9000 Series
OR
ciscoadaptive_security_appliance_softwareMatch4100 Series
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1.18 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)
OR
ciscoadaptive_security_appliance_softwareMatch3100 Series
OR
ciscoadaptive_security_appliance_softwareMatch2100 Series
OR
ciscoadaptive_security_appliance_softwareMatch1000 Series
OR
ciscoadaptive_security_appliance_softwareMatch3000 Series Industrial Security Appliances (ISA)
OR
ciscoadaptive_security_appliance_softwareMatch9000 Series
OR
ciscoadaptive_security_appliance_softwareMatch4100 Series
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1.22 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)
OR
ciscoadaptive_security_appliance_softwareMatch3100 Series
OR
ciscoadaptive_security_appliance_softwareMatch2100 Series
OR
ciscoadaptive_security_appliance_softwareMatch1000 Series
OR
ciscoadaptive_security_appliance_softwareMatch3000 Series Industrial Security Appliances (ISA)
OR
ciscoadaptive_security_appliance_softwareMatch9000 Series
OR
ciscoadaptive_security_appliance_softwareMatch4100 Series
OR
ciscoadaptive_security_appliance_softwareMatch9.19.1.24 when installed on Cisco Adaptive Security Virtual Appliance (ASAv)
OR
ciscoadaptive_security_appliance_softwareMatch3100 Series
OR
ciscoadaptive_security_appliance_softwareMatch4200 Series
OR
ciscoadaptive_security_appliance_softwareMatch4200 Series
OR
ciscofirepower_threat_defense_softwareMatch2100 Series
OR
ciscofirepower_threat_defense_softwareMatch1000 Series
OR
ciscofirepower_threat_defense_softwareMatch3000 Series Industrial Security Appliances (ISA)
OR
ciscofirepower_threat_defense_softwareMatch9000 Series
OR
ciscofirepower_threat_defense_softwareMatch4100 Series
OR
ciscofirepower_threat_defense_softwareMatch7.3.0 when installed on Cisco Secure Firewall Threat Defense Virtual
OR
ciscofirepower_threat_defense_softwareMatch3100 Series
OR
ciscofirepower_threat_defense_softwareMatch2100 Series
OR
ciscofirepower_threat_defense_softwareMatch1000 Series
OR
ciscofirepower_threat_defense_softwareMatch3000 Series Industrial Security Appliances (ISA)
OR
ciscofirepower_threat_defense_softwareMatch9000 Series
OR
ciscofirepower_threat_defense_softwareMatch4100 Series
OR
ciscofirepower_threat_defense_softwareMatch7.3.1 when installed on Cisco Secure Firewall Threat Defense Virtual
OR
ciscofirepower_threat_defense_softwareMatch3100 Series
OR
ciscofirepower_threat_defense_softwareMatch2100 Series
OR
ciscofirepower_threat_defense_softwareMatch1000 Series
OR
ciscofirepower_threat_defense_softwareMatch3000 Series Industrial Security Appliances (ISA)
OR
ciscofirepower_threat_defense_softwareMatch9000 Series
OR
ciscofirepower_threat_defense_softwareMatch4100 Series
OR
ciscofirepower_threat_defense_softwareMatch7.3.1.1 when installed on Cisco Secure Firewall Threat Defense Virtual
OR
ciscofirepower_threat_defense_softwareMatch3100 Series
OR
ciscofirepower_threat_defense_softwareMatch2100 Series
OR
ciscofirepower_threat_defense_softwareMatch1000 Series
OR
ciscofirepower_threat_defense_softwareMatch3000 Series Industrial Security Appliances (ISA)
OR
ciscofirepower_threat_defense_softwareMatch9000 Series
OR
ciscofirepower_threat_defense_softwareMatch4100 Series
OR
ciscofirepower_threat_defense_softwareMatch7.3.1.2 when installed on Cisco Secure Firewall Threat Defense Virtual
OR
ciscofirepower_threat_defense_softwareMatch3100 Series
OR
ciscofirepower_threat_defense_softwareMatch4200 Series

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

Related for CISCO-SA-ASAFTD-OGSNSG-ACLBYP-3XB8Q6JX