A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device.
An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

根據其自我報告的版本，遠端裝置上執行的 Cisco Adaptive Security Appliance (ASA) 軟體受到多個弱點影響。如需詳細資訊，請參閱隨附的 Cisco BID 和 Cisco 安全性公告。

遠端 Cisco 自適安全設備 (ASA) 遺漏供應商提供的一個安全性修補程式。因此，受到 web 介面中的一個弱點影響，這是因為不當驗證 HTTP URL 所致。未經驗證的遠端攻擊者可加以惡意利用，透過特製的 HTTP 要求造成 DoS 情形或在未經驗證的情況下洩漏資訊。此弱點適用於 IPv4 和 IPv6 HTTP 流量。

根据其自我报告的版本，远程设备上运行的 Cisco 自适应安全设备 (ASA) 软件受到多个漏洞的影响。若要了解更多信息，请参见所附的 Cisco BID 和 Cisco 安全公告。

远程 Cisco Adaptive Security Appliance (ASA) 缺少供应商提供的安全修补程序。因此，它受到其 Web 界面中的一个漏洞的影响，这是因为不当验证 HTTP URL 所导致。未经身份验证的远程攻击者可利用此情况，通过特制的 HTTP 请求，造成拒绝服务情况，或未经认证的信息披露。此漏洞适用于 IPv4 和 IPv6 HTTP 流量。

自己報告されたバージョンによると、リモートのデバイスで実行している Cisco Adaptive Security Appliance (ASA) は、複数のサービス拒否の脆弱性の影響を受けます。詳細については、付属のCisco BIDおよびCisco Security Advisoryを参照してください。

リモートのCisco Adaptive Security Appliance（ASA）に、ベンダーが提供したセキュリティパッチがありません。したがって、HTTP URLが不適切に検証されているため、Webインターフェイスの脆弱性による影響を受けます。認証されていないリモートの攻撃者がこれを悪用し、特別に細工されたHTTPリクエストを介してDoS状態を引き起こしたり、認証なしに情報を漏えいさせたりする可能性があります。この脆弱性は、IPv4およびIPv6のHTTPトラフィックに適用されます。

According to its self-reported version the Cisco Adaptive Security Appliance (ASA) software running on the remote device is affected by multiple vulnerabilities. Please see the included Cisco BIDs and Cisco Security Advisories for more information.

The remote Cisco Firepower Threat Defense (FTD) Software is missing a vendor-supplied security patch. It is, therefore, affected by a vulnerability in the web interface due to improper validation of the HTTP URL. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request, to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
506154	Rockwell Automation Allen-Bradley Stratix 5950 Improper Input Validation (CVE-2018-0296)	Tenable OT Security	Tenable.ot	2026/10/6	2026/10/6	high
110686	Cisco ASA 多個弱點 (cisco-sa-20180606-asaftd)	Nessus	CISCO	2018/6/25	2024/9/16	high
124172	Cisco ASA Web 介面 DoS (cisco-sa-20180606-asaftd)	Nessus	CISCO	2019/4/19	2024/7/26	high
110686	Cisco ASA 多个漏洞 (cisco-sa-20180606-asaftd)	Nessus	CISCO	2018/6/25	2024/9/16	high
124172	Cisco ASA Web 界面 DoS (cisco-sa-20180606-asaftd)	Nessus	CISCO	2019/4/19	2024/7/26	high
110686	Cisco ASAの複数の脆弱性（cisco-sa-20180606-asaftd）	Nessus	CISCO	2018/6/25	2024/9/16	high
124172	Cisco ASA WebインターフェイスDoS（cisco-sa-20180606-asaftd）	Nessus	CISCO	2019/4/19	2024/7/26	high
110686	Cisco ASA Web Services DoS (cisco-sa-20180606-asaftd)	Nessus	CISCO	2018/6/25	2024/9/16	high
124172	Cisco FTD Web Services DoS (cisco-sa-20180606-asaftd)	Nessus	CISCO	2019/4/19	2024/7/26	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high