Cisco ASA Remote Code Execution and Denial of Service Vulnerability [CVE-2018-0101]

Tracking Added February 7, 2018

A vulnerability in the Secure Sockets Layer (SSL) Virtual Private Network (VPN) functionality of the Cisco Adaptive Security Appliance (ASA) software [CVE-2018-0101] “could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code.”^[1]

The vulnerability occurs as a result of an attempt to double free a region of memory when the WebVPN feature is enabled on the Cisco ASA device: “An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a WebVPN-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device.”^[2]

Remediation

Cisco has released software updates that address this vulnerability. To see if a company in your portfolio is vulnerable, use the “Open Ports” filter in the Portfolio page.