Cisco Secure Firewall Threat Defense Software Web Services RCE (cisco-sa-http-code-exec-WmfP3h3O)

#TRUSTED ae34c6bf9303e7c044b077f1a1cdd64020bcdaf5b9eefe4b23b433323c87c12123e6f7ab7e45faffb91c2bfd0d57da93dde108c9f96b45220fbcbadb00e0318db9e9915bdd3666db1af3aa06258b9ee9e81aeaf092d9078fc997f57e1520a040aad7505dc62765086b51328a2f4c66917d977f88a7caca856439163e8c42604899d5da5e1dfe2b80268a231fcc8b2328a5652d8064e0ac59a992e0b9e8d894627a38e62221479c86d43e53991588a011d8be013ffe0c2300933d60810909b9c9ce875e23473e48c5048904c4442fd15827e30b5e1e599b36c79c185b57a09b75a64a5889401568f14849a62aef255b9460e48c44741e3920d9a57697daf2c88bf57b7db83c8f8a04c8548fe4c9e06484dab1eb1f1f775a5948eca4265ea94794510c6254aee141b1597b475ec2346d0982859545f77df3b03dc4360046a8a6d24ee5cbfbb309b490b9e7ecc78165e4653d4fbc583b7488e02e8291be0de87841262943b8d42bf33a81a0e32ea85a4e69c0ed2d9fc6ebaf9083553d040d2e0a48b06bb53a5fcfa4ba320ac8c7842bc7f50d322969393ad7e569875b9cab676a97963f9fc8964a2981762e79a05ece2a4dce8d5b0efbf83246d8c7a04771fe10cb5cd6fbc01d042fff57b1b4f87daab97ea5d5ca5f4fd7de152a2e4e4fff4e647824ec66fcf02f7264ecf812a9fdced533922f189b811f1a7e9135c77aa237e8cf
#TRUST-RSA-SHA256 3b09fe6e0745cf0d42f133b666f5db880ddfb6872ae8fb7c55c5a2d60334a8b8e8b05411c6a2dd121cc14bd79b1e38c29bf2d2860f7897b4c99eac6328f883829c8ac10b6bdc43e9d17ccc0d4f50a994669f00fc8d3d30aa811f6e5c0f6344d955765417880af43ebc22d68a5b800ca981c75085732c3a384250835244df6a5d691f8ece7ac83e59b56996fe193ccb912d14cba6be0e5478360bc8a562d3d5691f014f08bb7e95373e673e80e012176e4ad6a983ae426d6461484502f7b14cbe209d3ef85f504b267a56fe949400f0b69f9a5adb2a51b6897123bbe51365f00e11e2d3e934581c5085f2e4d74a15710ce8df4f6fb71f169e64832b6420bf027eefb5140cb96329837f0de6ad7c706f22551ab7c232e163276841c6df6635cfc321319210b09e5c87237a10807ee9604bce222b97496ae2800991857f827dd7b2e2b198b2b42d213dae30694014dded6286e03378275ec923c0a53df7ec3c79d81610b2a829d54d847b96dc99602f30b9b9470c691ea7534618dfbd6786b07196b460e427129e9bb13cf1175f64f7bd33373d51c6b05abf19ca20b3591081648bd271fae006c6b3fe7c21d5ec6a8c77666d170ca443ab6dda0be0efd330396193e92c9483e4ec4005b91e1c50ebd82f41c38821f26a91a425f3849c912ff4a4ac82721df89bdb72b16e7159683a23ebd0b9787aa4431339dc2b7a03d1e430cbd9
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(265972);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/26");

  script_cve_id("CVE-2025-20363");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwo18850");
  script_xref(name:"CISCO-SA", value:"cisco-sa-http-code-exec-WmfP3h3O");
  script_xref(name:"IAVA", value:"2025-A-0702");

  script_name(english:"Cisco Secure Firewall Threat Defense Software Web Services RCE (cisco-sa-http-code-exec-WmfP3h3O)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a vulnerability.

  - A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software,
    Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco
    IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or
    authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to
    execute arbitrary code on an affected device.  This vulnerability is due to improper validation of user-
    supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP
    requests to a targeted web service on an affected device after obtaining additional information about the
    system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute
    arbitrary code as root, which may lead to the complete compromise of the affected device. (CVE-2025-20363)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aded9b88");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwo18850");
  # https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3c68d455");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwo18850");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20363");

  script_cwe_id(122);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:firepower_threat_defense");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_enumerate_firepower.nbin");
  script_require_keys("installed_sw/Cisco Firepower Threat Defense");

  exit(0);
}

include('ccf.inc');
include('cisco_workarounds.inc');

var product_info = cisco::get_product_info(name:'Cisco Firepower Threat Defense');

var vuln_ranges = [
  {'min_ver':'7.0', 'fix_ver':'7.0.8'},
  {'min_ver':'7.1.0', 'fix_ver':'7.2.10'},
  {'min_ver':'7.3.0', 'fix_ver':'7.4.2.3'},
  {'min_ver':'7.6.0', 'fix_ver':'7.6.1'},
  {'min_ver':'7.7.0', 'fix_ver':'7.7.10'}
];

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = [
  WORKAROUND_CONFIG['ssl_vpn']
];

var reporting = make_array(
  'port'    , 0,
  'severity', SECURITY_HOLE,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwo18850',
  'cmds'    , make_list('show running-config')
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);