A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.
CVSS v3.1 (9.9)
AV NETWORK · AC LOW · PR LOW · UI NONE · S CHANGED
Critical risk with active exploitation against the VPN web server on Cisco ASA/FTD; urgent remediation required.
Why this matters
Root access on the firewall could enable full compromise of the device, enabling weaponisation of the network perimeter, credential theft, and lateral movement into internal networks. The combination of network access, low-privilege required, and no user interaction makes automated, rapid exploitation feasible in many environments.
Most likely attack path
An attacker with valid VPN credentials can reach the VPN web interface over the network, sending crafted HTTP requests to trigger arbitrary code execution with root privileges. The scope change indicates the exploit can escalate from initial access to complete device compromise, even without user interaction.
Who is most exposed
Organisations exposing Cisco ASA/FTD VPN web portals to the internet—especially those with remote workforces or MSP-based deployments—are most at risk.
Detection ideas
Look for unusual, crafted HTTP(S) requests targeting the VPN web interface (webvpn) and anomalous parameter usage.
Monitor VPN authentication activity for spikes, anomalous sources, or credential-stuffing patterns.
Detect config changes, reboots, or unexpected high-privilege actions following suspicious web requests.
Correlate with Cisco PSIRT advisories and attempted exploitation indicators in security event data.
Mitigation and prioritisation
Apply the fixed software release recommended by Cisco immediately; verify patch placement in test and production.
Enforce MFA for VPN access, restrict access by IP, and minimise exposure of the VPN web interface.
Consider compensating controls: restrict administrative access to management networks, enable strict logging, and implement segmentation around the firewall.
Plan a rapid, coordinated patch window; communicate changes across IT and security teams; validate backups and rollback procedures.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
