PT-2019-3822 · Cisco · Cisco Asa+1

Published 2019-10-02 · Updated 2023-08-16 · CVE-2019-12698

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description The issue is related to the WebVPN feature of the software, which is associated with an uncontrolled resource consumption. An unauthenticated, remote attacker could exploit this by sending multiple WebVPN HTTP page load requests for a specific URL, causing increased CPU utilization on the affected device. This could result in a denial of service (DoS) condition, potentially delaying traffic through the device. The vulnerability is due to excessive processing load for a specific WebVPN HTTP page request.

Recommendations For Cisco Adaptive Security Appliance (ASA) Software, consider restricting access to the WebVPN feature until a patch is available. For Cisco Firepower Threat Defense (FTD) Software, consider disabling the WebVPN HTTP page load request functionality for specific URLs until a fix is provided. As a temporary workaround, consider limiting the number of WebVPN HTTP page load requests from a single source to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2019-04149

CVE-2019-12698

Affected Products

Cisco Asa

Cisco Ftd

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-asa-ftd-dos · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12698 · Security Note
• https://bdu.fstec.ru/vul/2019-04149 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12698 · Vendor Advisory