Improper certificate validation in Cisco ASA 5500-X Series - CVE-2018-0227

Vulnerability identifier: #VU12092

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-0227

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to bypass security restrictions on the target system.

The weakness exists in the Secure Sockets Layer (SSL) Virtual Private Network (VPN) Client Certificate Authentication feature due to incorrect verification of the SSL Client Certificate. A remote attacker can connect to the ASA VPN without a proper private key and certificate pair, establish an SSL VPN connection to the ASA when the connection should have been rejected and bypass certain SSL certificate verification steps.

Cisco ASA 5500-X Series
Allen-Bradley Stratix 5950 1783-SAD4T0SBK9
Allen-Bradley Stratix 5950 1783-SAD4T0SPK9
Allen-Bradley Stratix 5950 1783-SAD2T2SBK9
Allen-Bradley Stratix 5950 1783-SAD2T2SPK9

Update to versions 100.13(0.174), 96.2(0.167), 9.6(4), 9.6(3.18) or 9.4(4.14).

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa1

• Multiple vulnerabilities in Cisco ASA 5500-X Series
• Multiple vulnerabilities in Rockwell Automation Allen-Bradley Stratix 5950