This vulnerability could allow an authenticated but unprivileged (levels 0 and 1) user to perform privileged actions when command authorization is disabled on the Cisco ASA.
When command authorization is not enabled, the ASA distinguishes only between unprivileged (levels 0 and 1) and privileged (levels 2 through 15) users. Privileged (levels 2 through 15) users are expected to have full administrative access to the ASA via the web management interface, even without knowing the enable password. Command authorization is disabled on the ASA by default.
An attacker could trigger the flaw exploit by sending specific HTTP requests via HTTPS to an affected device as an unprivileged user.
Remote privilege escalation; Attackers can read or write files on the system, overwrite firmware and create new users.
Cisco ASA 5500-X Series Firewall 9.9 (2)
Cisco ASA 9.1
Cisco ASA 9.2
Cisco ASA 9.3
Cisco ASA 9.4
Cisco ASA 9.5
Cisco ASA 9.6
Cisco ASA 9.7
Cisco ASA 9.8
Cisco ASA 9.9
Cisco ASA 9.10
Enabling command authorization will prevent from the exploitation of this vulnerability.
Vendor has released updates/patches for this vulnerability.
Customers are advised to migrate to a supported release (220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, or 188.8.131.52).
If you think you’re a victim of a cyber-attack, immediately send an email to firstname.lastname@example.org for a quick response.