Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Network Security

Cisco Warns of Zero-Day Vulnerability in Security Appliances

Cisco informed customers on Wednesday that some of its security appliances are affected by a serious vulnerability that has been actively exploited.

Cisco informed customers on Wednesday that some of its security appliances are affected by a serious vulnerability that has been actively exploited.

The zero-day flaw, tracked as CVE-2018-15454, is related to the Session Initiation Protocol (SIP) inspection engine used in the company’s Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software.

A remote and unauthenticated attacker can exploit the vulnerability to cause an affected device to reload or consume CPU resources, resulting in a denial-of-service (DoS) condition. The bug, related to how SIP traffic is handled, can be triggered by sending specially crafted SIP requests to the targeted device at a high rate.

Cisco said it became aware of the vulnerability during the resolution of a technical assistance center (TAC) support case.

The flaw impacts ASA software version 9.4 and later and FTD software version 6.0 and later if SIP inspection is enabled – the feature is enabled by default. The list of affected products includes 3000 Series Industrial Security Appliance (ISA); ASA Virtual; ASA 5500-X firewall; ASA service modules for Catalyst 6500 and 7600 switches and routers; Firepower 2100, 4100 and 9300; and FTD Virtual.

No patches or workarounds are available at this time, but attacks can be mitigated by blocking hosts that launch attacks, disabling SIP inspection, and filtering out traffic with a “Sent-by Address” set to 0.0.0.0, which Cisco says has been used in many of the attacks it spotted.

As for indicators of compromise (IoC), Cisco noted that the show conn port 5060 command will show a large number of incomplete SIP connections if the vulnerability is being exploited. Furthermore, the show process cpu-usage non-zero sorted command will indicate high CPU usage.

“Successful exploitation of this vulnerability can also result in the affected device crashing and reloading. After the device boots up again, the output of show crashinfo will show an unknown abort of the DATAPATH thread. Customer should reach out to Cisco TAC with this information to determine whether the particular crash was related to exploitation of this vulnerability,” Cisco said.

Zero-day vulnerabilities in Cisco products are not very common. In the past two years, the company addressed two such flaws: one leaked by Shadow Brokers from the NSA-linked Equation Group, and one made public by WikiLeaks after it had been stolen from the CIA.

There were also at least two campaigns this year that exploited Cisco ASA vulnerabilities shortly after they were patched.

Related: Cisco Switches in Iran, Russia Hacked in Apparent Pro-US Attack

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Cyberwarfare

Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.