Cisco ASA Improper Input Validation (CVE-2018-0296)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506154);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/06");

  script_cve_id("CVE-2018-0296");

  script_name(english:"Cisco ASA Improper Input Validation (CVE-2018-0296)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the web interface of the Cisco Adaptive Security
Appliance (ASA) could allow an unauthenticated, remote attacker to
cause an affected device to reload unexpectedly, resulting in a denial
of service (DoS) condition. It is also possible on certain software
releases that the ASA will not reload, but an attacker could view
sensitive system information without authentication by using directory
traversal techniques. The vulnerability is due to lack of proper input
validation of the HTTP URL. An attacker could exploit this
vulnerability by sending a crafted HTTP request to an affected device.
An exploit could allow the attacker to cause a DoS condition or
unauthenticated disclosure of information. This vulnerability applies
to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA
Software and Cisco Firepower Threat Defense (FTD) Software that is
running on the following Cisco products: 3000 Series Industrial
Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series
Adaptive Security Appliances, ASA 5500-X Series Next-Generation
Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches
and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance
(ASAv), Firepower 2100 Series Security Appliance, Firepower 4100
Series Security Appliance, Firepower 9300 ASA Security Module, FTD
Virtual (FTDv). Cisco Bug IDs: CSCvi16029.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # http://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?43e5aa79");
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c235f451");
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c8591b08");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/104612");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1041076");
  script_set_attribute(attribute:"see_also", value:"https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01");
  script_set_attribute(attribute:"see_also", value:"https://www.exploit-db.com/exploits/44956/");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd
  # http://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd
  # https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0296
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0296");
  script_cwe_id(20, 22);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/06/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/06/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.1" :
        {"versionEndExcluding" : "9.1.7.29", "versionStartIncluding" : "9.1", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.2" :
        {"versionEndExcluding" : "9.2.4.33", "versionStartIncluding" : "9.2", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.3" :
        {"versionEndExcluding" : "9.4.4.18", "versionStartIncluding" : "9.3", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.5" :
        {"versionEndExcluding" : "9.6.4.8", "versionStartIncluding" : "9.5", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.7" :
        {"versionEndExcluding" : "9.7.1.24", "versionStartIncluding" : "9.7", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.8" :
        {"versionEndExcluding" : "9.8.2.28", "versionStartIncluding" : "9.8", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.9" :
        {"versionEndExcluding" : "9.9.2.1", "versionStartIncluding" : "9.9", "family" : "CiscoFirepower"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);