6 source-linked records in the current knowledge graph.
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA KEV ↗ · unattributed attributionCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA KEV ↗ · unattributed attributionCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA KEV ↗ · unattributed attributionCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA KEV ↗ · unattributed attributionCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attributionCisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface. Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attribution