⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2022-05-03. Required action: Apply updates per vendor instructions..

CVE-2018-0296 — Improper Input Validation in Cisco Adaptive Security Appliance Software

CWE-20 — Improper Input ValidationCWE-22 — Path Traversal25 documents12 sources
Severity
7.5HIGHNVD
EPSS
94.4%
top 0.02%
CISA KEV
KEV
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Cisco Adaptive Security Appliance SoftwareCisco Firepower Threat Defense
Timeline
PublishedJun 7
KEV addedNov 3
KEV dueMay 3
Latest updateAug 30
CISA Required Action: Apply updates per vendor instructions.

Description

A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDcisco/firepower_threat_defense6.0 — 6.1.0+5

🔴Vulnerability Details

3
GHSA
GHSA-h2mj-pqgp-xmmj: A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affect↗2022-05-13
▶
CVEList
CVE-2018-0296: A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affect↗2018-06-07
▶
VulnCheck
Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability↗2018
▶

💥Exploits & PoCs

4
Exploit-DB
Cisco Adaptive Security Appliance - Path Traversal (Metasploit)↗2019-08-12
▶
Exploit-DB
Cisco Adaptive Security Appliance - Path Traversal↗2018-06-28
▶
Nuclei
Cisco ASA - Local File Inclusion
▶
Nuclei
Cisco ASA Security Checks
▶

🔍Detection Rules

1
Suricata
ET EXPLOIT Cisco Adaptive Security Appliance - Path Traversal↗2018-06-29
▶

📋Vendor Advisories

2
CISA
Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability↗2021-11-03
▶
Cisco
Cisco Adaptive Security Appliance Web Services Denial of Service Vulnerability↗2018-06-06
▶

🕵️Threat Intelligence

3
Talos
Cisco ASA DoS bug attacked in wild↗2019-12-20
▶
Talos
Cisco ASA DoS bug attacked in wild↗2019-12-20
▶
Tenable
Cisco ASA Exploited in the Wild; FXOS, NX-OS Get High-Priority Patches↗2018-06-26
▶

💬Community

10
HackerOne
CVE-2018-0296 Cisco ASA Denial of Service & Path Traversal vulnerable on [mtn.co.ug]↗2024-08-30
▶
HackerOne
[CVE-2018-0296] Cisco VPN path traversal on the https://███████/ (██████)↗2024-07-19
▶
HackerOne
[CVE-2018-0296] Cisco VPN path traversal on the https://1████████ (https://████████.███.████████/)↗2024-07-19
▶
HackerOne
[CVE-2018-0296] Cisco VPN path traversal on the https://███ (████████████████)↗2024-07-19
▶
HackerOne
[CVE-2018-0296] Cisco VPN path traversal on the https://████████/ (no hostname)↗2024-07-19
▶
CVE-2018-0296 — Improper Input Validation in Cisco | cvebase