Hackers actively exploiting vulnerabilities in Cisco security appliances

Networking giant Cisco is warning customers that attackers are actively exploiting a vulnerability in the company”s Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software.

CVE-2018-15454 describes a vulnerability in the Session Initiation Protocol (SIP) inspection engine of ASA and FTD software. Exploited correctly, the flaw allows a remote attacker to deploy a denial of service (DoS) condition by reloading or triggering high CPU cycles.

Caused by improper handling of SIP traffic, the flaw could allow bad actors to send SIP requests designed to specifically trigger the issue at a high rate across an affected device.

While the vulnerability itself isn”t devastating, affected customers can nevertheless experience some downtime, with devices crashing and reloading.

The vulnerability is present in Cisco ASA Software Release 9.4 and later and Cisco FTD Software Release 6.0 and later. The following Cisco products running the software with SIP inspection enabled are confirmed as “affected:”

• 3000 Series Industrial Security Appliance (ISA)
• ASA 5500-X Series Next-Generation Firewalls
• ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
• Adaptive Security Virtual Appliance (ASAv)
• Firepower 2100 Series Security Appliance
• Firepower 4100 Series Security Appliance
• Firepower 9300 ASA Security Module
• FTD Virtual (FTDv)

Users will have to wait for Cisco to release patches for the affected hardware. More worryingly, the vulnerability is actively being exploited in the wild, Cisco says. The company”s advisory includes a few indicators of compromise, as well as some steps to mitigate risk. No true workarounds are currently available.