{"id":44293,"date":"2021-12-06T23:00:00","date_gmt":"2021-12-06T23:00:00","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/cisco-hit-with-software-and-physical-issues\/"},"modified":"2021-12-06T23:00:00","modified_gmt":"2021-12-06T23:00:00","slug":"cisco-hit-with-software-and-physical-issues","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/cisco-hit-with-software-and-physical-issues\/","title":{"rendered":"Cisco hit with software and physical issues"},"content":{"rendered":"
<\/div>\n

Cisco Systems has been hit with an unusual double-whammy of issues, one of them in software and one in hardware.<\/p>\n

First, the more serious issue, a firewall flaw. Security researcher Positive Technologies, which hunts for security vulnerabilities, posted a warning that a vulnerability in Cisco firewall appliances could allow hackers to cause them to fail.<\/p>\n

The problem is in the Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) firewalls. Forrester Research says there are more than a million of them deployed worldwide. Positive assessed the severity level of vulnerability as high and recommended users should install updates, which are available, as soon as possible.<\/p>\n

Positive Technologies\u2019 researcher Nikita Abramov wrote<\/a> \u201cIf hackers disrupt the operation of Cisco ASA and Cisco FTD, a company will be left without a firewall and remote access (VPN). If the attack is successful, remote employees or partners will not be able to access the internal network of the organization, and access from the outside will be restricted.\u201d<\/p>\n

He added that an attacker doesn\u2019t need elevated privileges or special access to exploit the vulnerability, just a simple HTTPS request, in which one of the parts will be different in size than expected by the device. Further parsing of the request will cause a buffer overflow, and the system will be abruptly shut down and then restart.<\/p>\n

In its own blog post<\/a> on the subject, Cisco said the vulnerabilities are due to improper input validation of HTTPS requests. An attacker could send a malicious HTTPS request to an affected device causing it to restart, resulting in a denial of service (DoS) condition.<\/p>\n