Multiple Flaws Patched in Cisco Adaptive Security Appliance and Firepower Threat Defense

Update 05/09/20: Removed reference to Firepower Management Center (FMC) as Cisco has confirmed that FMC is not affected.

Earlier this week, Cisco published 34 security advisories, including a bundled publication for 12 vulnerabilities rated as “High” in the Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)

Outside of multiple denial of service flaws, the most notable vulnerability identified was CVE-2020-3187, a path traversal flaw in the web services of Cisco’s ASA and FTD software. This flaw only exists when the WebVPN or AnyConnect features are configured.

For more information, including details on affected configurations and patch availability, please check out our blog.