Cisco closes critical leak in VPN function of ASA software

Network equipment manufacturer Cisco has patched a critical software leak for its ASA devices. This is present in the vpn feature and allows a remote attacker to execute code and take over the device.

Cisco has given the vulnerability, identifier CVE-2018-0101, a maximum cvss score of 10, making it a critical vulnerability. An attacker can only exploit the so-called double free leak if the web VPN function is enabled on the ASA network equipment. This is possible by using special XML packages, according to Cisco.

Vulnerable devices

That way it is possible to run code and take over the device, or to trigger a reload. The vulnerability is publicly known, according to Cisco, but the company says it is not aware of attackers who are actively using it.

Cisco has published a list of vulnerable devices and writes that the vulnerability is present in the so-called FTD software from version 6.2.2 because a remote access VPN function was introduced in that version.