- Vendor / Project
- Cisco
- Product
- Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
- Date added
- Nov 3, 2021
- Due date
- May 3, 2022
- Known ransomware use
- Unknown
- CWEs
- CWE-20
Description
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device.
Required action
Apply updates per vendor instructions.