CVE-2018-0296
Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability
Description
CVE-2018-0296 is a HIGH-severity denial-of-service and information disclosure vulnerability in the Cisco Adaptive Security Appliance (ASA) web interface, carrying a CVSS 3.1 score of 7.5. The vulnerability is caused by a lack of proper input validation of HTTP URLs, allowing an unauthenticated remote attacker to cause the device to reload unexpectedly or, on certain software releases, view sensitive system information through directory traversal without authentication. Affected products include Cisco ASA Software (versions 9.1 through 9.9) and Cisco Firepower Threat Defense Software (versions 6.0 through 6.2.3.1). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The EPSS score of 0.94360 (99.96th percentile) confirms an extremely high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | adaptive security appliance software | >= 9.1, < 9.1.7.29; >= 9.2, < 9.2.4.33; >= 9.3, < 9.4.4.18; >= 9.5, < 9.6.4.8; >= 9.7, < 9.7.1.24; >= 9.8, < 9.8.2.28; >= 9.9, < 9.9.2.1 |
| cisco | firepower threat defense | 6.2.3-85.02; 6.2.3-851 |
| cisco | secure firewall threat defense | >= 6.0, < 6.1.0; >= 6.2.1, < 6.2.2.3; 6.2.3; 6.2.3.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- http://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/104612(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1041076(Third Party Advisory, VDB Entry)
- https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01(Third Party Advisory, US Government Resource)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd(Vendor Advisory)
- https://www.exploit-db.com/exploits/44956/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0296(US Government Resource)
Weakness Type
CWE-22: Path Traversal
CVE-2018-0296 is classified under CWE-22 — Path Traversal and CWE-20 — Improper Input Validation. Path traversal occurs when software uses external input to construct a pathname but fails to properly neutralize special elements like ".." that can resolve to locations outside the restricted directory. Improper input validation occurs when a product fails to validate that input has the properties required for safe processing.
In the context of the Cisco ASA web interface, the vulnerability allows attackers to use directory traversal techniques in HTTP URL requests to access files and directories outside the intended web root. Depending on the software version, this can cause the device to crash and reload (denial of service) or enable unauthenticated access to sensitive system information. The Cisco ASA is a critical perimeter security device, making this vulnerability particularly dangerous as it directly targets the network's first line of defense.
Learn more: CWE-22 — Path Traversal
Impact Analysis
CVE-2018-0296 carries a CVSS 3.1 score of 7.5 (HIGH) with Unchanged Scope.
Confidentiality (NONE in primary vector): While the primary CVSS vector rates confidentiality as NONE, certain software versions allow unauthenticated information disclosure through directory traversal, exposing sensitive system details.
Integrity (NONE): The vulnerability does not allow direct modification of system files or configurations.
Availability (HIGH): The primary impact is denial of service. Successful exploitation can cause the affected ASA device to reload unexpectedly, disrupting all network traffic that flows through the firewall. Given the ASA's role as a perimeter security device, this can result in a complete network outage.
Scope Unchanged: The impact is contained within the Cisco ASA device itself, though the downstream effects of a firewall outage can be significant.
With an EPSS score of 0.94360 (99.96th percentile), this vulnerability is among the most actively exploited, reflecting its attractiveness as a target for network disruption attacks.
Exploit Maturity
CVE-2018-0296 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: Public exploits are available on Exploit-DB and PacketStorm. The exploitation is straightforward, requiring only crafted HTTP requests to the ASA web interface. The vulnerability affects both IPv4 and IPv6 HTTP traffic, broadening the attack surface.
Ransomware association: No direct ransomware association has been confirmed for CVE-2018-0296. However, crashing the ASA firewall can disable network security controls and create an opening for subsequent attacks including ransomware deployment.
Attack surface: The vulnerability affects the ASA web interface, which is commonly exposed for remote administration and VPN portal access. The wide range of affected products — from the ASA 5500 series to Firepower appliances — means a large installed base is potentially vulnerable. ICS-CERT also issued an advisory highlighting the risk to industrial environments.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. Organizations should prioritize patching all internet-facing ASA devices immediately.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Consult Cisco's security advisory (cisco-sa-20180606-asaftd) for the specific fixed software versions for your ASA or FTD platform.
- Identify all affected devices. Cisco ASA Software versions 9.1 through 9.9 and Cisco Firepower Threat Defense versions 6.0 through 6.2.3.1 are affected. Verify software versions across your entire ASA and FTD fleet including the 3000 Series ISA, ASA 5500/5500-X, ASAv, and Firepower 2100/4100/9300.
- Restrict web interface access. If the ASA web interface is not required for VPN portal access, disable it. If it must remain enabled, restrict access to trusted IP addresses using access control lists.
- Monitor for exploitation attempts. Deploy IDS/IPS signatures to detect directory traversal patterns in HTTP requests to ASA web interfaces. Review web server logs on ASA devices for suspicious URL patterns.
- Implement redundancy. Ensure ASA devices are deployed in high-availability pairs to minimize the impact of a denial-of-service attack that causes a device reload.
- Verify no prior compromise. Examine device logs for unexpected reloads or access to sensitive system files. Investigate any anomalies that may indicate prior exploitation.
Technical Details
CVE-2018-0296 is a HIGH-severity vulnerability exploitable over the network with low attack complexity. No authentication or user interaction is required.
Technical mechanism: The Cisco ASA web interface fails to properly validate HTTP URLs, allowing directory traversal attacks. An attacker sends crafted HTTP requests containing path traversal sequences to the ASA web interface. Depending on the software version, this can trigger one of two outcomes: (1) the device reloads unexpectedly, causing a denial of service, or (2) the attacker can view sensitive system information without authentication using directory traversal techniques. The vulnerability applies to both IPv4 and IPv6 HTTP traffic.
CVSS 3.1 vector analysis (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): The primary vector reflects the denial-of-service impact with network-based access, low complexity, no privileges required, and no user interaction needed. The HIGH availability impact reflects the complete disruption caused by an unexpected device reload.
Affected products: Cisco ASA Software (9.1 through 9.9 branches) and Cisco FTD Software (6.0 through 6.2.3.1) running on 3000 Series ISA, ASA 1000V, ASA 5500/5500-X, ASA Services Module, ASAv, and Firepower 2100/4100/9300 platforms.
Frequently Asked Questions
Is CVE-2018-0296 being actively exploited?
Yes, CVE-2018-0296 is actively exploited in the wild. Public exploits exist on Exploit-DB and PacketStorm, and mass scanning for vulnerable ASA devices has been documented. The EPSS score of 0.94360 (99.96th percentile) confirms extremely high exploitation activity. The vulnerability is listed in CISA's KEV catalog.
What products are affected by CVE-2018-0296?
The vulnerability affects Cisco ASA Software versions 9.1 through 9.9 and Cisco Firepower Threat Defense Software versions 6.0 through 6.2.3.1. This includes ASA 5500 series, ASA 5500-X series, ASA 1000V, 3000 Series ISA, ASAv, Firepower 2100/4100/9300, and ASA Services Module for Catalyst 6500/7600.
How do I fix CVE-2018-0296?
Apply the fixed software versions specified in Cisco's advisory (cisco-sa-20180606-asaftd). Restrict access to the ASA web interface to trusted IP addresses. Deploy ASA devices in high-availability pairs to minimize denial-of-service impact.
How severe is CVE-2018-0296?
CVE-2018-0296 is rated HIGH with a CVSS 3.1 score of 7.5. The primary risk is denial of service through unexpected device reloads, with potential information disclosure on certain software versions. Given the ASA's role as a critical perimeter security device, exploitation can disrupt an entire network's connectivity and security posture.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.