Horizon Alert
Summary of the vulnerability and why it matters
Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software contain a vulnerability within their remote access VPN feature. This flaw could allow an unauthorized, remote attacker to attempt to discover valid user credentials through brute force. In some instances, an authenticated attacker could establish an unauthorized clientless SSL VPN session.
- Vulnerable remote access VPN feature
- Improper separation of authentication and authorization
- Compromised user credentials and unauthorized access
Attack Path
How an attacker could exploit the issue
This vulnerability could allow an attacker to gain unauthorized access to an organization's network. An unauthenticated attacker could attempt to guess valid user credentials through brute force. Alternatively, an authenticated attacker could establish an unauthorized session using valid credentials. Exploitation could lead to the identification of valid credentials for further network access or the establishment of an unauthorized VPN session.
- Exposure of the remote access VPN feature.
- Attacker performs a brute force or uses valid credentials.
- Control or impact: Unauthorized VPN session established.
Live Threat
Current exploitation, exposure, and threat context
Attackers with moderate technical skill can exploit this vulnerability. The exploitation requires unauthenticated remote access and the presence of specific configurations, such as SSL VPN being enabled on an interface and user credentials existing in the local database or an AAA server. The potential damage includes the discovery of valid credentials for unauthorized VPN access or the establishment of unauthorized clientless SSL VPN sessions, posing a significant business risk.
- Low to moderate attacker skill level.
- Unauthenticated remote access required.
- High business risk; urgent remediation.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability impacts organizations using Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software for remote access VPNs. An unauthenticated attacker could exploit this to perform brute-force attacks to discover credentials or establish unauthorized VPN sessions. Authenticated attackers could also exploit this to establish unauthorized clientless SSL VPN sessions. Successful exploitation could lead to compromised access to internal systems and data, posing a significant business risk.
- Find all exposed Cisco ASA and FTD assets.
- Implement workarounds to reduce exposure.
- Apply vendor fixes, verify, and monitor.
