Cisco Secure Adaptive Security Appliance Remote Access VPN Web Server DoS (cisco-sa-asaftd-vpnwebs-dos-hjBhmBsX)

#TRUSTED 7f3215e4682105320d647260d8e6d3e5e6ea2065b339100c341c42edd5a3cdc9d0cc5af87204852cfd891458394b9192854f48379510ca837fc0b973243317ca202cad61b20fb9047be6afdad6bd2dd0c69469bea2ba2d753ac90257bf0af0632798c829e1dc9660b1978c8e8a7e7629c14998abae7e285f4d5ba3ff4ac0ff7fb6766e0fcecbc529544bc68d45027ce31e4fbb031bbd8f269802a8ba4232a62ad81f9eab77b2141cd9f572da6f03383a5c3afe02357b9091e1cb26be9da83d32954e21661d8e15a21824b5b49009467ecf062ecd42be3888f761678f09a214bef15a91649135c65ed5c1dfc8822338ea44c4c2f5d1645fcc457165613d9d0a3531001339a7daf33293ce69e97300a23e75dde1bcd159e2fb696e4712b74490f1960f4d278f818ad5f467a902364c4a8b874149308f48886f01f89d09d518d99fdcf306a23803767b4344955cdda3dea12d88a3d9c8062cce85bf50d2a97c29aaa6e6726d398d2bc67925a62a9e3473c4d76a1781a000be13b042af9fbd9ed87795cc752b8d1447429c5a08d7dd165ea5403bb8a9629e2edc290c26964e7ec714aa08a0bb7843d84480eff9bcdf084d8f42fa21b10c4fb2329e49cbfa91ac1b8a0b5569b9c73d656b9fab75512fbd06393051a8f8838ffe706f4012034f835967a1d589ce01a76e225aed04840d18aeec35bb6c52c7f8f080c1a134dd5cf465a3
#TRUST-RSA-SHA256 9812b2ae532ceb82073d66744d2e0025a8f297efb20155b5509f0f355a7b85a3d12d41a8bb5d6896f9a4e44b1a404a33f8e815edd829914293f2ebb39613b489751e9d4d0cc9fb2c093f10da67492f7047737c9afe481fb94144af9dd25b5fc0633834bc2baf5d4d55b8929704bef5f6173663bade2af93a3a472ba7c27b0a4e3859b2daf540dfa1768951065b3fa888d8110d4084a2e48ad050c860f5dc5c8c4d9fe048730d47c6277e278b140067058460b1990232aa90523c14c0d9c5f30aeead33346a0cffd0b29526cabcb4f0639e38fc0bbfab882effc650644e103343f26559f3b36226367787bc8a21dde8d4700f9a31afb0a838b090a969d3420c6ef7908cd1e709d90eb49ba3dcfb897f7fa1fea6bfd84416b714d977b314ff8da1ac56794db146e444e71da35f80a5b6d2d59d927a47d96f22111ba203fe43b5400b2c7b9d701273368e79af5035716c7ed2e4265d87c6719de5e050efa1c05fa3743b77e6158027c9a06ba0a5004f8fdaa5059a76e735ec628ec7cac92d3163a6672c97d03c59e0225d8b97a10c9f864bffdeeb5f51697de5e99361c7b6866099af89a01ab387ec31c2b987c91b20a5e001eb4b584c0013b8c75244283cfd7ea669e181277ca83dbb0ab0a8fb128c4f3f28483a730536a81c4b8d08e917261c06e0f3a19ebebcdb0bd3c77b2ddf9ab6d876aa78db23688e81d923ffadb4df1c1b
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(255228);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/08/26");

  script_cve_id("CVE-2025-20244");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwo08017");
  script_xref(name:"CISCO-SA", value:"cisco-sa-asaftd-vpnwebs-dos-hjBhmBsX");
  script_xref(name:"IAVA", value:"2025-A-0612");

  script_name(english:"Cisco Secure Adaptive Security Appliance Remote Access VPN Web Server DoS (cisco-sa-asaftd-vpnwebs-dos-hjBhmBsX)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Adaptive Security Appliance (ASA) Software is affected by a vulnerability.

  - A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance
    (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow a remote attacker that
    is authenticated as a VPN user to cause the device to reload unexpectedly, resulting in a denial of
    service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP
    header field value. An attacker could exploit this vulnerability by sending a crafted HTTP request to a
    targeted Remote Access SSL VPN service on an affected device. A successful exploit could allow the
    attacker to cause a DoS condition, which would cause the affected device to reload. (CVE-2025-20244)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpnwebs-dos-hjBhmBsX
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5aa60a33");
  # https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75415
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8bc70a07");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwo08017");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwo08017");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20244");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(1287);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:adaptive_security_appliance_software");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/Cisco/ASA/model");

  exit(0);
}

include('ccf.inc');
include('cisco_workarounds.inc');

var product_info = cisco::get_product_info(name:'Cisco Adaptive Security Appliance (ASA) Software');

var vuln_ranges = [
  {'min_ver':'9.8.1', 'fix_ver':'9.16.4.84'},
  {'min_ver':'9.17.1', 'fix_ver':'9.17.1.46'},
  {'min_ver':'9.18.1', 'fix_ver':'9.18.4.47'},
  {'min_ver':'9.19.1', 'fix_ver':'9.19.1.37'},
  {'min_ver':'9.20.1', 'fix_ver':'9.20.3.7'},
  {'min_ver':'9.22.1.1', 'fix_ver':'9.22.1.3'}
];

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = [
  WORKAROUND_CONFIG['anyconnect_client_services'],
  WORKAROUND_CONFIG['mobile_user_security'],
  WORKAROUND_CONFIG['ssl_vpn']
];

var reporting = make_array(
  'port'    , 0,
  'severity', SECURITY_WARNING,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwo08017'
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);