Cisco Releases Security Updates for ASA and FTD Software

Cisco has released security updates to address a vulnerability in Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software Web Service. A remote attacker could exploit this vulnerability to obtain sensitive information. The Cybersecurity and Infrastructure Security Agenc...

Directory traversal

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability i...

CVE-2020-3452

CVE-2020-3452 affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) web services. The issue is due to improper input validation of URLs in HTTP requests, enabling unauthenticated, remote attackers to perform directory traversal and read files from the web services filesystem (enable...

CVE-2020-3452 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability i...

CVE-2020-3452 Cisco ASA / Firepower Read-Only Path Traversal Vulnerability

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability i...

PT-2020-3662

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software affected versions not specified Description A flaw exists in the web services interface of Cisco ASA and FTD Software due to insufficient validation...

Acronis: Local File Disclosure /Delete On [us-az-vpn.acronis.com]

Cisco ASA VPN server hosted on https://us-az-vpn.acronis.com was found to be using an outdated version that suffers from a Local File Disclosure /Delete vulnerability. Through this vulnerability an unauthenticated remote attacker can read and delete the contents of any file stored on the VPN serv...

Cisco ASA Software DHCP DoS (cisco-sa-asaftd-dos-qk8cTGLz)

According to its self-reported version, Cisco ASA Software is affected by a denial-of-service DoS vulnerability in the DHCP component due to incorrect processing of certain DHCP packets. An authenticated, remote attacker can exploit this, by sending a crafted DHCP packet to the affected device, t...

Cisco ASA Authentication Bypass (EXTRABACON)

This module patches the authentication functions of a Cisco ASA to allow uncredentialed logins. Uses improved shellcode for payload. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco ASA...

Avaya IP Office 11 Insecure Transit / Password Disclosure Vulnerability

Avaya IP Office versions 9.1.8.0 through 11 suffer from an insecure transit vulnerability that allows for password disclosure. + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Lightweight Directory Access Protocol Denial of Service Vulnerability (cisco-sa-20190501-asa-ftds-ldapdos)

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a vulnerability in the implementation of the Lightweight Directory Access Protocol LDAP feature in Cisco Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software could allow an...

Cisco Adaptive Security Appliance Software Lightweight Directory Access Protocol Denial of Service Vulnerability (cisco-sa-20190501-asa-ftds-ldapdos)

According to its self-reported version, the Cisco ASA device is affected by a vulnerability in the implementation of the Lightweight Directory Access Protocol LDAP feature in Cisco Adaptive Security Appliance ASA Software and Firepower Threat Defense FTD Software could allow an unauthenticated,...

Cisco Adaptive Security Appliance Software CSRF (cisco-sa-20190501-asa-csrf)

According to its self-reported version, Cisco Adaptive Security Appliance ASA Software is affected by a cross-site request forgery CSRF attack in the web-based management interface due to insufficient CSRF protections. An unauthenticated, remote attacker can exploit this, by persuading a user of...

The vulnerability of the implementation of the Open Shortest Path First (OSPF) protocol in Cisco Adaptive Security Appliance (ASA) and Configure Firepower Threat Defense (FTD) software allows a attacker to induce a service failure.

The vulnerability of the OSPF implementation in Cisco Adaptive Security Appliance ASA and Configure Firepower Threat Defense FTD software relates to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Cisco Adaptive Security Appliance Denial of Service (cisco-sa-fp2100-arp-dos-kLdCK8ks)

A denial of service vulnerability exists in the ARP packet processing component of Cisco Adaptive Security Appliance ASA software due to insufficient validation of ARP data. An unauthenticated, adjacent attacker can exploit this to cause to cause the system to stop responding. Please see the...

Cisco Fixes High-Severity Flaws In Firepower Security Software, ASA

Cisco has stomped out 12 high-severity vulnerabilities across several network security products. The flaws can be exploited by unauthenticated remote attackers to launch an array of attacks – from denial of service DoS to sniffing out sensitive data. Specifically affected is Cisco’s Firepower...

CVE-2020-3303

A vulnerability in the Internet Key Exchange version 1 IKEv1 feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper...

CVE-2020-3305

A vulnerability in the implementation of the Border Gateway Protocol BGP module in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to...

CVE-2020-3305

A vulnerability in the implementation of the Border Gateway Protocol BGP module in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to...

CVE-2020-3306

A vulnerability in the DHCP module of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on the affected device. The vulnerability is due to incorrect processing ...