A flaw in Cisco ASA and FTD firewalls lets anyone on the internet make the device restart through the VPN service. Update to a fixed release.
Cisco Secure Firewall ASA and FTD are firewalls that protect many company networks. A logic error in the remote access SSL VPN service, when secondary authentication is set up on a tunnel group, lets an attacker with no login send a crafted request that makes the device reload.
The attack causes an outage. Cisco's advisory describes denial of service, not break-in.
If the firewall restarts, staff lose their VPN and often the office loses its internet protection until it comes back. Repeated attacks can keep it down.
| Version | Safe version | Status |
|---|---|---|
| ASA 9.16 | 9.16.4.104 or later | Fixed |
| ASA 9.18 | 9.18.4.96 or later | Fixed |
| ASA 9.19 and 9.20 | 9.20.4.50 or later | Fixed |
| ASA 9.22 | 9.22.3.200 or later | Fixed |
| ASA 9.23 | 9.23.1.48 or later | Fixed |
| ASA 9.24 | 9.24.1.27 or later | Fixed |
| FTD 7.0 | 7.0.11 or later | Fixed |
| FTD 7.2 | 7.2.13 or later | Fixed |
| FTD 7.4 and 7.3 | 7.4.9 or later | Fixed |
| FTD 7.6 | A release after 7.6.7 (see Cisco) | Check |
| FTD 7.7 | 7.7.14 or later | Fixed |
| FTD 10.0 | 10.0.3 or later | Fixed |
National agencies and the software maker only. Pick a country.
Tell us what you can see. Our quick response team will pick this up as a priority.