Cisco Secure Firewall Adaptive Security Appliance Software Web Services RCE (cisco-sa-http-code-exec-WmfP3h3O)

#TRUSTED 187a1ed8dbe3a30d8693f82f56208f21ca660051d36f7a49b389d27b87d75ee10fee0be6428ff138b13a49751b40eb2b4fd47009690ca488be58cccb00b1a0810bc76d7d393e897f1f214d40a82b317d18946e4447d144a5d1851e55506f17f2443ecf980b6bdffb4d9224c93d7f28798ab17427da8ff15d6a41950fc4540a43f9af1ea7fffdcf91455dc08e634b58c332653632e9b949edabad215b35f205447062a5b3b3be142afbbd3bf29d50e34b61d516f5275a0b456578b14b407d74531e6e09246382a691e8f592c9e09d97c2e7442b3e98d7e88ad0ebb6cd07c73a5df1b0df5cd0934a9fcbfded915763691659c92fa2e4d90c6f77cd01fac01dcd4cce8abc7077224096bb35fbd37b0b4fbab943b20b9ee1205d4004ae34f793feec53ef0d931bd328724273cf293308cc3f1ea44d46dce611ff7d29fa4b75b02185168db688482c1edae20e465e4f9383f27e1831a1d01665564a46faec3b37f92e27727894e79cc3df8f4140959da0912dc95a2dd19fdfd210bdec8a9032395f97118514933efaeb2051c48d4260b35224816f2ffdb38afe2fc811f9adf00127117fbf8e134756d5be283f225ff127e87b9bc6f927e86cfb5462b33f2322d816b7a20afebcf07e3ed5792d339020300984b3cbdfbba1a8b914e04316fec32dfd65852dc6bbf0e6a564b15939556d7bc90d3ae8658a4883a08db43415fa7ba21867
#TRUST-RSA-SHA256 090d8d05efc4cd2de3f3f8e7ae0095904d50804d2c94718af4bce06a87c73ef91bec31986f774da27a1f588a28012549611fef4f2c159bb0dc84797f3510727a1fee42be67b8f03db3a3f612a5db892c5dfc5b1ee76f4aef44cb2c632cc1a75a0ecaa42e900e212c0d657cfcb11ab56c08e997ad06138a6fb662f7ae8a4655b4579c541b763e6581fa49b7ea96246062da42227bb514e6234e8c293f989de17f407f6edfe8271a9b71f6cd9884c075e1e9adfd0c0607a234130e59c2c61e7b145c12f7c047e188426cb5b43c95626a4d05cc52891d607cca4a3e6f72e70aa4f3bc40d120d996404c5a127830cb5cda019768176f18004ec643ab99a03490306a94f275d41ba0030972bdd4c0b4538af72a6582773c713dc73f113cd96adba15818a021f86444692907c56a73c499f44e461590d93405702687377a7084134c183e5500f427b9475df9fb167036459e98f24364010390143c075a8c874cc18ceca17682ae174ce7762d7f49f55812cf53acb1289242e0092b16e99b41dc3ac6ebe6dd4a115f67e8978d7481d9af8a648d7fd9fd2e1cd18446245e604d3c7336003c79436d79a9227a8bbbd0660edac7cec12a54c6445d46fdce1c18965d298715e383cdaf72025151be85abfcf167036f4dc9f454474e078d1449630ba7bb968c5e047ac63b1b3619a7c6569af343c23547eee05ee1d17da9e5f270192b31334e
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(265973);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/26");

  script_cve_id("CVE-2025-20363");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwo18850");
  script_xref(name:"CISCO-SA", value:"cisco-sa-http-code-exec-WmfP3h3O");
  script_xref(name:"IAVA", value:"2025-A-0702");

  script_name(english:"Cisco Secure Firewall Adaptive Security Appliance Software Web Services RCE (cisco-sa-http-code-exec-WmfP3h3O)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Adaptive Security Appliance (ASA) Software is affected by a vulnerability.

  - A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software,
    Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco
    IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or
    authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to
    execute arbitrary code on an affected device.  This vulnerability is due to improper validation of user-
    supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP
    requests to a targeted web service on an affected device after obtaining additional information about the
    system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute
    arbitrary code as root, which may lead to the complete compromise of the affected device. (CVE-2025-20363)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aded9b88");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwo18850");
  # https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3c68d455");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwo18850, CSCwo35704, CSCwo35779, CSCwo49562");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20363");

  script_cwe_id(122);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:adaptive_security_appliance_software");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/Cisco/ASA/model");

  exit(0);
}

include('ccf.inc');
include('cisco_workarounds.inc');

var product_info = cisco::get_product_info(name:'Cisco Adaptive Security Appliance (ASA) Software');

var vuln_ranges = [
  {'min_ver':'9.16', 'fix_ver':'9.16.4.84'},
  {'min_ver':'9.17', 'fix_ver':'9.18.4.57'},
  {'min_ver':'9.19', 'fix_ver':'9.19.1.42'},
  {'min_ver':'9.20', 'fix_ver':'9.20.3.16'},
  {'min_ver':'9.22', 'fix_ver':'9.22.2'},
  {'min_ver':'9.23', 'fix_ver':'9.23.1.3'},
];

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = [
  WORKAROUND_CONFIG['mobile_user_security'],
  WORKAROUND_CONFIG['ssl_vpn']
];

var reporting = make_array(
  'port'    , 0,
  'severity', SECURITY_HOLE,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwo18850',
  'cmds'    , make_list('show running-config')
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);