VULNERABILITY
Cisco Zero-Day Anchor 'ArcaneDoor' Cyber Espionage Campaign
Cisco Adaptive Security Appliance and Firepower Threat Defense Software:
- Web Services Denial of Service Vulnerability
- Persistent Local Code Execution Vulnerability
- Command Injection Vulnerability
What it affects:
- Cisco ASA/Cisco FTD
What is NOT affected:
- Cisco FMC
Please review the scope of work below prior to authorizing NCI to remediate.
CVE-2024-20353
- Resource link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-websrvs-dos-X8gNucD2
- Cisco Adaptive Security Appliance and Firepower Threat Defense Software Web Services Denial of Service Vulnerability
- A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
- This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.
CVE-2024-20359
- Resource link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h
- Cisco Adaptive Security Appliance and Firepower Threat Defense Software Persistent Local Code Execution Vulnerability
- A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability.
- This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.
CVE-2024-20358
- Resource link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-cmd-inj-ZJV8Wysm
- Cisco Adaptive Security Appliance and Firepower Threat Defense Software Command Injection Vulnerability.
- A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. Administrator-level privileges are required to exploit this vulnerability.
- This vulnerability exists because the contents of a backup file are improperly sanitized at restore time. An attacker could exploit this vulnerability by restoring a crafted backup file to an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system as root.
Scope of work:
Verify current running software via Cisco’s Software Checker for patched software for Cisco ASA/FTD
A restart will be required in order to complete the remediation. A total of 3 hours at time and materials per device estimated to complete this remediation.
If you would like to schedule the remediation work outside of your business hours please have the point of contact in your support ticket communicate with our scheduling team so we can accommodate.
By completing the following form, you agree to the scope of work and remediation estimate.
