What is it?
Cisco provides VPN firewall software (Cisco Secure Firewall).
Three components of this product: Adaptive Security Appliance (ASA), Firewall Management Center (FMC) and Firewall Threat Defence (FTD)
contain a vulnerability that could allow an authenticated, remote attacker to execute arbitrary code on an affected server.
Why is it a risk?
This is a CRITICAL vulnerability.
This vulnerability is currently being actively exploited by state-sponsored threat actors
known as Storm-1849.
How can you mitigate the risk?
First, use the Cisco Software Checker (link below) to confirm that the installed version of your router software is affected; you will need to know your software version.
There are no workarounds for this vulnerability. Administrators are advised to implement an intrusion prevention system (IPS) or intrusion detection system (IDS) to help detect and prevent attacks that attempt to exploit this vulnerability.
Cisco customers with current service contracts may obtain updates that resolve this problem through their Cisco (re)seller. The Threat Advisory document linked below explains the procedure, including a procedure for customers without a service contract. Search for ‘Fixed Software’.
Resources
Cisco Software Checker
https://sec.cloudapps.cisco.com/security/center/softwarechecker.x
Cisco Threat Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
