MERIT Solutions Blog

The Cisco Vulnerability Requires Multiple Patches

The Cisco Vulnerability Requires Multiple Patches

Virtual private networks are vulnerable to an exploit that was recently brought to light. Cisco has announced that this exploit undermines its ASA, or Adaptive Security Appliance tool. If this issue isn’t patched immediately, you could find your organization vulnerable through remote code exploitation.

This VPN bug can leverage the ASA operating system to enable hackers to breach Cisco security devices. According to Cisco, this Secure Sockets Layer (SSL) can “allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code.” This means that an attacker could hypothetically gain complete access to a system and control it - a prospect that any business should see the threat in, especially where their physical security is concerned. In fact, this vulnerability has been ranked as a 10 out of 10 on the Common Vulnerability Score System, making it one of the top vulnerabilities ranked.

Granted, this vulnerability only goes into effect if WebVPN has been enabled, but that doesn’t mean that you can overlook this threat. ZDNet provides the following list of affected devices:

  • 3000 Series Industrial Security Appliance (ISA)
  • ASA 5500 Series Adaptive Security Appliances
  • ASA 5500-X Series Next-Generation Firewalls
  • ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
  • ASA 1000V Cloud Firewall
  • Adaptive Security Virtual Appliance (ASAv)
  • Firepower 2100 Series Security Appliance
  • Firepower 4110 Security Appliance
  • Firepower 9300 ASA Security Module
  • Firepower Threat Defense Software (FTD).

When it was first discovered, this bug had yet to be used “in the wild,” but Cisco was aware of some attempts to change that. This exploit targeted a bug from seven years ago, with a proof of concept demonstrating the use of the exploit - or at least trying to. The proof of concept only resulted in a system crash, but that doesn’t change the fact that this vulnerability can be exploited in other ways, too.

Unfortunately, this vulnerability has now been observed in use, and worse, Cisco’s first attempt to patch it didn’t see to all considerations. As it turned out, there were more attack vectors and features that were not yet identified, as so were not addressed by the patch.

However, Cisco has now released an updated patch, which you need to implement as soon as possible. Otherwise, you are opening up your business security to greater risk. It is always a better practice to attend to known vulnerabilities post haste, as the longer your business is vulnerable, the more likely it is that someone will take advantage of that.

Furthermore, it is also crucial that you stay cognizant of any and all vulnerabilities that are present in your mission-critical software and hardware solutions. This bug is not an isolated case. Others like it have been found before, and more will certainly pop up in the future. Hackers and cybercriminals are constantly working to overcome the security features that software developers implement. It is your responsibility to ensure that you protect your business by implementing security patches and updates promptly.

MERIT Solutions can assist you with that. We can help you ensure that your patches and updates are up-to-date, often without needing to take the time needed for an on-site visit and handling it all remotely. For more information, give us a call at (757) 420-5150.

Can You Spot the Bait in a Phishing Attack?
Tip of the Week: Which Browser Provides the Best S...


No comments made yet. Be the first to submit a comment
Already Registered? Login Here
Monday, October 25 2021

Captcha Image

By accepting you will be accessing a service provided by a third-party external to

Mobile? Grab this Article!

QR-Code dieser Seite

Recent Comments

Tim Meyers Tip of the Week: Change Your Display in Windows 10
26 August 2019
Don't change only your operating system, change your display as well with a modern sunlight readable...
Tim Meyers E-Waste: An Often-Forgotten Environmental Issue
23 August 2019
E-waste and recycling and other waste management activities have not yet been determined, but they a...
Tim Meyers How to find the ideal desk height
23 August 2019
The table where you sit should be at the right height because it is necessary to have a good positio...
Tim Meyers Self-Driving Cars: Would You Hand the Wheel Over to a Computer?
23 August 2019
Self-driving cars are just cars, so they might have sensors, but no computer brain. Still, they are ...
Tim Meyers Checking Up on Medical IT in 2019
23 August 2019
Because almost all the personal information of the patients are on computers and on a cloud storage ...