WaratekVRT Sign in

CVE-2018-0296 Cisco Firepower Threat Defense

Affected softwareCisco Firepower Threat Defense
Severity7.5 High CVSS 3.1 3 scores
WeaknessPath traversal (CWE-22)
Published7 Jun 2018
Updated11 Aug 2026

Description

A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.

CWE-20 · Improper input validation

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2022-05-03 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 12 citations · honeypot sightings · 5 exploits · earliest 2019-04-17.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: partial.
  • Indexed PoC 7 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Nuclei; first seen 2018-06-21.
  • EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2018-0296 in VulnCheck (free account), which lists 7 more citations not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 422 days 2023-11-15 to 2026-11-10
Reported exploitation blog.talosintelligence.com /2019/04/seaturtle.html 2019-04-17
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2021-11-03
Reported exploitation 25491742.fs1.hubspotusercontent-eu1.net /hubfs/25491742/WAZAWAKA_TLPCLEAR_Report.pdf 2023-12-20
Reported exploitation blog.talosintelligence.com /ir-trends-ransomware-on-the-rise-q2-2024 2024-07-25
Reported exploitation f5.com /labs/articles/threat-intelligence/sensor-intel-series-top-cves-june-2024 2024-07-25
Exploit reference VulnCheck XDB 766776ee90cd Exploit type: info-leak 2018-06-21
Exploit reference VulnCheck XDB 02e9e2c8837a Exploit type: infoleak 2018-06-22
Exploit reference VulnCheck XDB 72ff33aee22f Exploit type: info-leak 2018-07-13
Exploit reference VulnCheck XDB ad80b13bd026 Exploit type: info-leak 2018-12-19
Exploit reference VulnCheck XDB 990d9dcf809d Exploit type: infoleak 2023-12-21

2 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Script to test for Cisco ASA path traversal vulnerability (CVE-2018-0296) and extract system information. 204 2018-06-21
GitHub PoC Test CVE-2018-0296 and extract usernames 106 2018-06-21
GitHub PoC Cisco ASA - CVE-2018-0296 | Exploit 1 2018-06-22
Exploit-DB Cisco Adaptive Security Appliance - Path Traversal (Metasploit) 2019-08-12
GitHub PoC https://github.com/milo2012/CVE-2018-0296.git 2018-12-19
Exploit-DB Cisco Adaptive Security Appliance - Path Traversal 2018-06-28
Nuclei Cisco ASA - Local File Inclusion

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary published
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CISA-ADP Secondary
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:N/I:N/A:P NVD Primary

Affected software and releases

Products and versions

3 products, 13 version entries
SourceVendorProductSchemeAffected versions
nvd cisco adaptive security appliance software generic ≥ 9.1 and ＜ 9.1.7.29 · ≥ 9.2 and ＜ 9.2.4.33 · ≥ 9.3 and ＜ 9.4.4.18 · ≥ 9.5 and ＜ 9.6.4.8 · ≥ 9.7 and ＜ 9.7.1.24 · ≥ 9.8 and ＜ 9.8.2.28 · ≥ 9.9 and ＜ 9.9.2.1
nvd cisco firepower threat defense generic 6.2.3-85.02 · 6.2.3-851
nvd cisco secure firewall threat defense generic ≥ 6.0 and ＜ 6.1.0 · ≥ 6.2.1 and ＜ 6.2.2.3 · 6.2.3 · 6.2.3.1

References

URLTags
http://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/104612 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041076 Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01 Third Party Advisory, US Government Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd Vendor Advisory
https://www.exploit-db.com/exploits/44956/ Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0296 US Government Resource

Timeline
Published2018-06-07By the CVE Program.
VulnCheck KEV: earliest evidence2019-04-17Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2021-11-03Listed in CISA's Known Exploited Vulnerabilities catalog.
NVD record modified2026-08-11NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-10Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.