Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
A flaw in Cisco Secure Firewall's Remote Access SSL VPN service allows an attacker to crash the device by sending a specially crafted HTTP request, causing it to restart and interrupt all network traffic. This happens because the software doesn't properly check incoming requests.
The vulnerability exists in HTTP request processing within the Remote Access SSL VPN service of ASA and FTD software due to insufficient error checking (CWE-244). An unauthenticated remote attacker can exploit this by sending a malformed HTTP request to the VPN endpoint, triggering an unexpected device reload and resulting in denial of service.