PT-2018-1851 · Cisco · Cisco Asa+1

Yassineaboukir · Published 2018-06-06 · Updated 2025-10-28 · CVE-2018-0296

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description The issue is related to insufficient validation of HTTP requests in the web interface of the Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software. This could allow a remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition, or view sensitive system information without authentication by using directory traversal techniques. The vulnerability affects IPv4 and IPv6 HTTP traffic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

RCE

Path traversal

Weakness Enumeration

CWE-20

CWE-22

Related Identifiers

BDU:2018-01453

CVE-2018-0296

Affected Products

Cisco Asa

Cisco Ftd

References · 21

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/cisco_directory_traversal.rb · Exploit
• 🔥 https://github.com/yassineaboukir/CVE-2018-0296 · Exploit
• 🔥 https://github.com/milo2012/CVE-2018-0296 · Exploit
• 🔥 https://exploit-db.com/exploits/44956 · Exploit
• 🔥 https://exploit-db.com/exploits/47220 · Exploit
• 🔥 http://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html · Exploit
• 🔥 https://milo2012.wordpress.com/2018/06/21/cve-2018-0296-script-to-extract-usernames-from-cisco-asa-devices · Exploit
• https://osv.dev/vulnerability/CVE-2018-0296 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0296 · Security Note
• https://bdu.fstec.ru/vul/2018-01453 · Security Note
• https://t.me/cybersecuritytechnologies/518 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01 · Note