Skip to content
Fencer Intel
high 7.5

CVE-2018-0296 kev in the critical feed json

A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to caus…

published 2018-06-07 8 y ago modified 2026-08-11 2 mo ago also EUVD-2018-1119

cvss
7.5
version 3.1, CNA
cisa kev
Exploited
added 2021-11-03
epss
99.9%
EPSS 99.9% chance of exploitation in 30 days, percentile 99.9%
public exploits
3
Metasploit, Exploit-DB, plus a Nuclei check

Summary

A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • cisco secure_firewall_threat_defense 6.1.0, 6.2.2.3
  • cisco adaptive_security_appliance_software 9.1.7.29, 9.2.4.33, 9.4.4.18, 9.6.4.8, 9.7.1.24, 9.8.2.28, 9.9.2.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-18-184-01 updated cvss 8.6

Rockwell Automation Allen-Bradley Stratix 5950

  • Rockwell Automation Allen-Bradley Stratix 5950 1783-SAD4T0SBK9, 1783-SAD2T2SPK9, 1783-SAD4T0SPK9, 1783-SAD2T2SBK9
    affected: mitigation “CVE-2018-0296 — Cisco has released Snort Rule 46897” cisco.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. First public exploit (Metasploit auxiliary/scanner/http/cisco_directory_traversal)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
5 y ago
Patch by
2022-05-03 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Cisco, Adaptive Security Appliance (ASA)
CISA name
Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1202 Indirect Command Execution exploitation
  • T1005 Data from Local System primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

99.90% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • n/a Cisco Adaptive Security Appliance unknown

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.