Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software run many organisations' perimeter firewalls and remote access VPNs, the encrypted connections staff use to reach the internal network from outside. A flaw in the SSL VPN service lets an attacker send a specially crafted connection request that makes the firewall restart unexpectedly. The attacker does not need a password or an account.

Each restart cuts off traffic through the device, including VPN users and possibly other network traffic, until it comes back up. This is called a denial of service (DoS). Repeated attacks could keep the device offline. The problem only applies when the VPN uses secondary authentication, meaning a second login step configured on a VPN profile (a tunnel group). Any organisation running these Cisco products with that setup should act now, because CISA has confirmed attackers are already using this flaw.