Vulnerability identifier: #VU99291
Vulnerability risk: High
CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-772
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Cisco Firepower Threat Defense (FTD)
Hardware solutions /
Security hardware applicances
Cisco Adaptive Security Appliance (ASA)
Hardware solutions /
Security hardware applicances
Vendor: Cisco Systems, Inc
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to resource exhaustion in the Remote Access VPN (RAVPN) service. A remote attacker can perform password spraying attack, cause resource exhaustion and perform a denial of service attack against the RAVPN service.
Note, the vulnerability is being actively exploited in the wild.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Cisco Firepower Threat Defense (FTD): 7.0.0 - 7.0.6.2
Cisco Adaptive Security Appliance (ASA): 9.16 - 9.16.4.61, 9.17 - 9.17.1.39, 9.20.1 - 9.20.2.21, 9.18 - 9.18.4.24, 9.19.1 - 9.19.1.31
External links
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-bf-dos-vDZhLqrW
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCwj45822
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCwj91570
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.