PT-2017-12474 · Cisco · Cisco Asa Next-Generation Firewall Services

Published 2017-11-16 · Updated 2019-10-09 · CVE-2017-12299

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco ASA Next-Generation Firewall Services (affected versions not specified)

Description A vulnerability exists in the process of creating default IP blocks during device initialization that could allow an unauthenticated, remote attacker to send traffic to the local IP address of the device, bypassing any filters that are configured to deny local IP management traffic. This is due to an implementation error in the process of creating default IP blocks when the device is initialized and how those IP blocks interact with user-configured filters for local IP management traffic, such as SSH to the device. An attacker could exploit this by sending traffic to the local IP address of the targeted device, potentially allowing the attacker to connect to the device even when filters are configured to deny the traffic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-12299

Affected Products

Cisco Asa Next-Generation Firewall Services

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-firepower1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12299 · Security Note
• http://securityfocus.com/bid/101915 · Note