Security restrictions bypass in Cisco Adaptive Security Appliance and Firepower Threat Defense

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU57767

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-34787

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists in the identity-based firewall (IDFW) rule processing feature. A remote attacker can send a specially crafted network request to bypass access control list (ACL) rules on the device, bypass security protections, and send network traffic to unauthorized hosts.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ASA 5500-X Series Firewalls: All versions

Cisco Adaptive Security Appliance (ASA): before

Cisco Firepower Threat Defense (FTD): before

CPE2.3

• cpe:2.3:a:cisco_systems:asa_5500-x_series_firewalls:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:asa:*:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_ftd:*:*:*:*:*:*:*:*

External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rule-bypass-ejjOgQEY
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx47895

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.