CVE-2019-15992
HighCVSS 7.2Exploitation Probability (EPSS)
High risk90th percentile - higher than 90% of all known CVEs
Summary
A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating system of an affected device. The vulnerability is due to insufficient restrictions on allowed Lua function calls within the context of user-supplied Lua scripts. A successful exploit could trigger a heap overflow and execute arbitrary code with root privileges.
Risk Assessment
The risk includes the possibility of full device compromise by an attacker with root privileges, which could lead to complete system and network compromise. The attack requires authentication but could be used for further attacks.
Recommendation
It is recommended to apply Cisco ASA/FTD software updates that contain fixes for this vulnerability. Also, restrict access to devices and monitor activities of privileged users.
Other vulnerabilities in Cisco ASA/FTD
See all- CVE-2024-20481MediumActively exploited
A vulnerability in the Remote Access VPN (RAVPN) service of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. The issue is due to resource exhaustion. A successful exploit could exhaust resources, resulting in DoS of the RAVPN service, and a device reload may be required to restore service.
- CVE-2024-20359MediumActively exploited
A vulnerability in a legacy capability for preloading VPN clients and plug-ins in Cisco ASA and FTD Software allows an authenticated, local attacker with administrator privileges to execute arbitrary code with root-level privileges. The issue is due to improper validation of a file read from system flash memory. A successful exploit could allow code execution after the next reload, potentially altering system behavior.
- CVE-2024-20353HighActively exploited
A vulnerability in the management and VPN web servers of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to cause an unexpected reload, resulting in DoS. The issue is due to incomplete error checking when parsing an HTTP header. A successful exploit could cause a DoS condition when the device reloads.
- CVE-2022-20759High
A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15. This vulnerability is due to improper separation of authentication and authorization scopes. An attacker could exploit this vulnerability by sending crafted HTTPS messages to the web services interface of an affected device. A successful exploit could allow the attacker to gain privilege level 15 access to the web management interface of the device, including via tools like ASDM or CSM. For FTD, the impact is lower because the management interface allows read-only access.
- CVE-2020-3580MediumActively exploited
Multiple vulnerabilities in the web services interface of Cisco ASA and FTD Software allow an unauthenticated, remote attacker to conduct XSS attacks against users of the interface. The issues are due to insufficient validation of user-supplied input. A successful exploit could allow arbitrary script execution in the interface context or access to sensitive browser-based information.
- CVE-2020-3452HighActively exploited
A vulnerability in the web services interface of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to perform directory traversal attacks and read sensitive files. The issue is due to lack of proper input validation of URLs in HTTP requests. A successful exploit allows viewing arbitrary files within the web services file system when WebVPN or AnyConnect features are enabled.
- CVE-2020-3259HighActively exploited
A vulnerability in the web services interface of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to retrieve memory contents, potentially leading to disclosure of confidential information. The issue is due to a buffer tracking issue when parsing invalid URLs. A successful exploit could allow memory contents retrieval, leading to information disclosure.
- CVE-2020-3187Critical
A vulnerability in the web services interface of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files. The issue is due to lack of proper input validation of the HTTP URL. A successful exploit could allow viewing or deleting arbitrary files in the web services file system, but files are restored after device reload.
- CVE-2018-15454High
A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload or trigger high CPU, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of SIP traffic. An attacker could exploit this vulnerability by sending SIP requests designed to trigger this issue at a high rate. Software updates addressing this vulnerability are not yet available.
- CVE-2018-0296HighActively exploited
A vulnerability in the web interface of Cisco ASA could allow an unauthenticated, remote attacker to cause an unexpected reload, resulting in DoS. In certain releases, directory traversal could also allow unauthenticated disclosure of sensitive system information. The issue is due to lack of proper input validation of the HTTP URL.
Original NVD description (English source)
A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating system of an affected device. The vulnerability is due to insufficient restrictions on the allowed Lua function calls within the context of user-supplied Lua scripts. A successful exploit could allow the attacker to trigger a heap overflow condition and execute arbitrary code with root privileges on the underlying Linux operating system of an affected device.