CVE-2018-15398: Cisco Adaptive Security Appliance Access Control List Bypass Vulnerability
A vulnerability in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass an access control list (ACL) that is configured for an interface of an affected device. The vulnerability is due to errors that could occur when the affected software constructs and applies per-user-override rules. An attacker could exploit this vulnerability by connecting to a network through an affected device that has a vulnerable configuration. A successful exploit could allow the attacker to access resources that are behind the affected device and would typically be protected by the interface ACL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure any resources behind an affected Cisco ASA/FTD interface remain protected by the interface ACL, and do not allow access to the affected device from untrusted networks that could bypass the ACL via the per-user-override configuration.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-15398?
CVE-2018-15398 is rated as a high severity vulnerability due to its potential to allow unauthorized access.
How do I fix CVE-2018-15398?
To mitigate CVE-2018-15398, users should upgrade their Cisco ASA or FTD software to the latest version recommended by Cisco.
Which Cisco products are affected by CVE-2018-15398?
CVE-2018-15398 affects Cisco Adaptive Security Appliance Software versions 9.4(2), 9.4(4), 9.6(4.3) and Cisco Firepower Threat Defense Software version 6.2.0.
What impact does CVE-2018-15398 have on network security?
CVE-2018-15398 allows attackers to bypass access control lists, potentially compromising network security.
Is authentication required to exploit CVE-2018-15398?
No, CVE-2018-15398 can be exploited by unauthenticated, remote attackers.