Networking giant Cisco is warning customers that attackers are actively exploiting a vulnerability in the company”s Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software.
CVE-2018-15454 describes a vulnerability in the Session Initiation Protocol (SIP) inspection engine of ASA and FTD software. Exploited correctly, the flaw allows a remote attacker to deploy a denial of service (DoS) condition by reloading or triggering high CPU cycles.
Caused by improper handling of SIP traffic, the flaw could allow bad actors to send SIP requests designed to specifically trigger the issue at a high rate across an affected device.
While the vulnerability itself isn”t devastating, affected customers can nevertheless experience some downtime, with devices crashing and reloading.
The vulnerability is present in Cisco ASA Software Release 9.4 and later and Cisco FTD Software Release 6.0 and later. The following Cisco products running the software with SIP inspection enabled are confirmed as “affected:”
Users will have to wait for Cisco to release patches for the affected hardware. More worryingly, the vulnerability is actively being exploited in the wild, Cisco says. The company”s advisory includes a few indicators of compromise, as well as some steps to mitigate risk. No true workarounds are currently available.