Lucene search

K
ciscoCiscoCISCO-SA-ASAFTD-OGSNSG-ACLBYP-3XB8Q6JX
HistoryMay 22, 2024 - 4:00 p.m.

Cisco Adaptive Security Appliance and Firepower Threat Defense Software Inactive-to-Active ACL Bypass Vulnerability

2024-05-2216:00:00
tools.cisco.com
6
cisco
asa
ftd
acl
vulnerability
logic error
remote attacker
access control list
ipv4
ipv6
interface
software update
security advisory

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

A vulnerability in the activation of an access control list (ACL) on Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL on an affected device.

This vulnerability is due to a logic error that occurs when an ACL changes from inactive to active in the running configuration of an affected device. An attacker could exploit this vulnerability by sending traffic through the affected device that should be denied by the configured ACL. The reverse condition is also trueβ€”traffic that should be permitted could be denied by the configured ACL. A successful exploit could allow the attacker to bypass configured ACL protections on the affected device, allowing the attacker to access trusted networks that the device might be protecting.

Note: This vulnerability applies to both IPv4 and IPv6 traffic as well as dual-stack ACL configurations in which both IPv4 and IPv6 ACLs are configured on an interface.

Cisco has released software updates that address this vulnerability. There is a workaround that addresses this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ogsnsg-aclbyp-3XB8q6jX [β€œhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ogsnsg-aclbyp-3XB8q6jX”]

This advisory is part of the May 2024 release of the Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: May 2024 Semiannual Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication [β€œhttps://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75298”].

Affected configurations

Vulners
Node
ciscoadaptive_security_virtual_applianceMatch9.19
OR
ciscoadaptive_security_virtual_applianceMatch9.20
OR
ciscofirepowerMatchany
OR
ciscoasr_1000_series_softwareMatchany
OR
ciscoindustrial_network_directorMatchany
OR
cisconx-osMatchanynexus_9000_series
OR
ciscofirepowerMatchany
OR
ciscoadaptive_security_virtual_applianceMatchany
OR
ciscopix_firewallMatchany
OR
ciscopix_firewallMatchany
OR
ciscofirepower_threat_defense_softwareMatch7.3
OR
ciscofirepower_threat_defense_softwareMatch7.4
OR
ciscofirepowerMatchany
OR
ciscoasr_1000_series_softwareMatchany
OR
ciscoindustrial_network_directorMatchany
OR
cisconx-osMatchanynexus_9000_series
OR
ciscofirepowerMatchany
OR
ciscofirepower_threat_defenseMatchany
OR
ciscopix_firewallMatchany
OR
ciscopix_firewallMatchany
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1.5
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1.9
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1.12
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1.18
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1.22
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1.24
OR
ciscoadaptive_security_virtual_applianceMatch9.20.1
OR
ciscoadaptive_security_virtual_applianceMatch9.20.1.5
OR
ciscofirepower_services_for_adaptive_security_applianceMatch2100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch1000_series
OR
ciscoadaptive_security_virtual_applianceMatch3000_series_industrial_security_appliances_\(isa\)
OR
ciscofirepower_services_for_adaptive_security_applianceMatch9000_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch4100_series
OR
ciscoadaptive_security_virtual_applianceMatchany
OR
ciscoadaptive_security_virtual_applianceMatch3100_series
OR
ciscoadaptive_security_virtual_applianceMatch4200_series
OR
ciscofirepower_threat_defense_softwareMatch7.3.0
OR
ciscofirepower_threat_defense_softwareMatch7.3.1
OR
ciscofirepower_threat_defense_softwareMatch7.3.1.1
OR
ciscofirepower_threat_defense_softwareMatch7.3.1.2
OR
ciscofirepower_threat_defense_softwareMatch7.4.0
OR
ciscofirepower_threat_defense_softwareMatch2100_series
OR
ciscofirepower_threat_defense_softwareMatch1000_series
OR
ciscofirepower_threat_defense_softwareMatch3000_series_industrial_security_appliances_\(isa\)
OR
ciscofirepower_threat_defense_softwareMatch9000_series
OR
ciscofirepower_threat_defense_softwareMatch4100_series
OR
ciscofirepower_threat_defense_softwareMatchany
OR
ciscofirepower_threat_defense_softwareMatch3100_series
OR
ciscofirepower_threat_defense_softwareMatch4200_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch2100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch1000_series
OR
ciscoadaptive_security_virtual_applianceMatch3000_series_industrial_security_appliances_\(isa\)
OR
ciscofirepower_services_for_adaptive_security_applianceMatch9000_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch4100_series
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1_when_installed_on_cisco_adaptive_security_virtual_appliance_\(asav\)
OR
ciscoadaptive_security_virtual_applianceMatch3100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch2100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch1000_series
OR
ciscoadaptive_security_virtual_applianceMatch3000_series_industrial_security_appliances_\(isa\)
OR
ciscofirepower_services_for_adaptive_security_applianceMatch9000_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch4100_series
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1.5_when_installed_on_cisco_adaptive_security_virtual_appliance_\(asav\)
OR
ciscoadaptive_security_virtual_applianceMatch3100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch2100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch1000_series
OR
ciscoadaptive_security_virtual_applianceMatch3000_series_industrial_security_appliances_\(isa\)
OR
ciscofirepower_services_for_adaptive_security_applianceMatch9000_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch4100_series
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1.9_when_installed_on_cisco_adaptive_security_virtual_appliance_\(asav\)
OR
ciscoadaptive_security_virtual_applianceMatch3100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch2100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch1000_series
OR
ciscoadaptive_security_virtual_applianceMatch3000_series_industrial_security_appliances_\(isa\)
OR
ciscofirepower_services_for_adaptive_security_applianceMatch9000_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch4100_series
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1.12_when_installed_on_cisco_adaptive_security_virtual_appliance_\(asav\)
OR
ciscoadaptive_security_virtual_applianceMatch3100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch2100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch1000_series
OR
ciscoadaptive_security_virtual_applianceMatch3000_series_industrial_security_appliances_\(isa\)
OR
ciscofirepower_services_for_adaptive_security_applianceMatch9000_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch4100_series
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1.18_when_installed_on_cisco_adaptive_security_virtual_appliance_\(asav\)
OR
ciscoadaptive_security_virtual_applianceMatch3100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch2100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch1000_series
OR
ciscoadaptive_security_virtual_applianceMatch3000_series_industrial_security_appliances_\(isa\)
OR
ciscofirepower_services_for_adaptive_security_applianceMatch9000_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch4100_series
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1.22_when_installed_on_cisco_adaptive_security_virtual_appliance_\(asav\)
OR
ciscoadaptive_security_virtual_applianceMatch3100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch2100_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch1000_series
OR
ciscoadaptive_security_virtual_applianceMatch3000_series_industrial_security_appliances_\(isa\)
OR
ciscofirepower_services_for_adaptive_security_applianceMatch9000_series
OR
ciscofirepower_services_for_adaptive_security_applianceMatch4100_series
OR
ciscoadaptive_security_virtual_applianceMatch9.19.1.24_when_installed_on_cisco_adaptive_security_virtual_appliance_\(asav\)
OR
ciscoadaptive_security_virtual_applianceMatch3100_series
OR
ciscoadaptive_security_virtual_applianceMatch4200_series
OR
ciscoadaptive_security_virtual_applianceMatch4200_series
OR
ciscofirepower_threat_defense_softwareMatch2100_series
OR
ciscofirepower_threat_defense_softwareMatch1000_series
OR
ciscofirepower_threat_defense_softwareMatch3000_series_industrial_security_appliances_\(isa\)
OR
ciscofirepower_threat_defense_softwareMatch9000_series
OR
ciscofirepower_threat_defense_softwareMatch4100_series
OR
ciscofirepower_threat_defense_softwareMatch7.3.0_when_installed_on_cisco_secure_firewall_threat_defense_virtual
OR
ciscofirepower_threat_defense_softwareMatch3100_series
OR
ciscofirepower_threat_defense_softwareMatch2100_series
OR
ciscofirepower_threat_defense_softwareMatch1000_series
OR
ciscofirepower_threat_defense_softwareMatch3000_series_industrial_security_appliances_\(isa\)
OR
ciscofirepower_threat_defense_softwareMatch9000_series
OR
ciscofirepower_threat_defense_softwareMatch4100_series
OR
ciscofirepower_threat_defense_softwareMatch7.3.1_when_installed_on_cisco_secure_firewall_threat_defense_virtual
OR
ciscofirepower_threat_defense_softwareMatch3100_series
OR
ciscofirepower_threat_defense_softwareMatch2100_series
OR
ciscofirepower_threat_defense_softwareMatch1000_series
OR
ciscofirepower_threat_defense_softwareMatch3000_series_industrial_security_appliances_\(isa\)
OR
ciscofirepower_threat_defense_softwareMatch9000_series
OR
ciscofirepower_threat_defense_softwareMatch4100_series
OR
ciscofirepower_threat_defense_softwareMatch7.3.1.1_when_installed_on_cisco_secure_firewall_threat_defense_virtual
OR
ciscofirepower_threat_defense_softwareMatch3100_series
OR
ciscofirepower_threat_defense_softwareMatch2100_series
OR
ciscofirepower_threat_defense_softwareMatch1000_series
OR
ciscofirepower_threat_defense_softwareMatch3000_series_industrial_security_appliances_\(isa\)
OR
ciscofirepower_threat_defense_softwareMatch9000_series
OR
ciscofirepower_threat_defense_softwareMatch4100_series
OR
ciscofirepower_threat_defense_softwareMatch7.3.1.2_when_installed_on_cisco_secure_firewall_threat_defense_virtual
OR
ciscofirepower_threat_defense_softwareMatch3100_series
OR
ciscofirepower_threat_defense_softwareMatch4200_series

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

Related for CISCO-SA-ASAFTD-OGSNSG-ACLBYP-3XB8Q6JX