Summary
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.
- Vendor
- Cisco
- Product
- Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
- Added to KEV
- Feb 15, 2024
- Remediation due
- Mar 7, 2024 (US federal deadline)
- Ransomware use
- Known
- Weakness
- CWE-200
- EPSS
- 71.5% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References