A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints without authentication that should otherwise be inaccessible without authentication.
This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.
CVSS v3.1 (6.5)
AV NETWORK · AC LOW · PR NONE · UI NONE · S UNCHANGED
This vulnerability poses a medium-risk but urgent threat due to active exploitation in the wild and its inclusion in the KEV catalog, requiring immediate attention. It matters because unauthenticated attackers can bypass access controls on VPN web servers, potentially exposing sensitive internal resources without credentials, disrupting secure remote access, and undermining perimeter security. Attackers can exploit this remotely without authentication or user interaction, leveraging low-complexity crafted HTTP(S) requests directly over the network, with no privilege requirements and no scope change, making lateral movement less likely without further footholds. Organisations running Cisco ASA or Firepower Threat Defense with VPN web servers exposed to public networks are most vulnerable, particularly where these products enforce critical remote access controls in enterprise settings. Detection should focus on anomalous HTTP(S) requests targeting VPN web interfaces, unexpected access to normally restricted URL endpoints, spikes in unauthenticated GET or POST requests, unusual VPN web session patterns, and correlating external IP addresses with threat intelligence feeds for known exploit attempts. Mitigation requires prompt application of vendor patches designated as priority one due to active exploitation; network-level controls to restrict administrative VPN access; monitoring for suspicious web traffic patterns; and thorough change management to ensure no interruption to critical VPN services during patch deployment.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
