#VU57797 Improperly implemented security check for standard in Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) - CVE-2021-34791

Vulnerability identifier: #VU57797

Vulnerability risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-34791

CWE-ID: CWE-358

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco Adaptive Security Appliance (ASA)
Hardware solutions / Security hardware applicances
Cisco Firepower Threat Defense (FTD)
Hardware solutions / Security hardware applicances

Vendor: Cisco Systems, Inc

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient traffic validation within the File Transfer Protocol (FTP) Application Level Gateway (ALG) for the Network Address Translation (NAT) feature. A remote attacker can send a specially crafted FTP traffic, open unauthorized connections to the remote host and undertake actions leveraging that host. 

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Cisco Adaptive Security Appliance (ASA): 9.8, 9.12 - 9.15

Cisco Firepower Threat Defense (FTD): 6.2.2, 6.2.3, 6.3.0, 6.4.0, 6.5.0, 6.6.0, 6.7.0

---

External links
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-natalg-bypass-cpKGqkng

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.