Cisco Secure Firewall ASA and FTD Software VPN Web Server Unauthorized Access Vulnerability

A vulnerability exists in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. It allows an unauthenticated, remote attacker to access restricted URL endpoints without authentication, which should otherwise be inaccessible. This vulnerability arises from improper validation of user-supplied input in HTTP(S) requests. Exploitation involves sending crafted HTTP requests to the targeted web server, potentially allowing access to restricted URLs without authentication.

Impact

Successful exploitation could lead to unauthorized access of restricted URLs, bypassing authentication requirements.

Remediation

Cisco has released software updates to address this vulnerability. Customers are advised to upgrade to a fixed software release. For Cisco Secure Firewall ASA Software, the fixed releases vary by version, with the earliest being 9.12.4.72. For Cisco Secure FTD Software, the first fixed release is 7.0.8.1. Instructions for downloading the fixed releases are available on the Cisco Software Download Center.