Act today High Patch available
Attackers exploit Cisco firewall flaw to cause denial of service
CSA SingaporeCisco Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense
What happened. CSA Singapore says attackers are exploiting a high-severity flaw in Cisco Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense to cause denial of service. It advises patching immediately.
Who is affected. Users of Cisco Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense. Sites using these as boundary firewalls or for remote access are exposed. The report gives no versions.
What to do. Check whether you run Cisco Adaptive Security Appliance Software or Cisco Secure Firewall Threat Defense, and apply the Cisco patch immediately.
When to act. Act today: the source reports it has been used in attacks
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L5
- L3.5
Why: A boundary firewall sits at the edge between enterprise and internet (L5) and in front of the industrial DMZ (L3.5).
- Are you exposed?
Check your asset inventory for Cisco ASA or Secure Firewall Threat Defense devices and compare their software against the Cisco advisory.
- If you cannot fix it yet
- Restrict management and VPN interfaces on the firewall to known source addresses.
- Plan a maintenance window and a failover path so a firewall outage does not cut off plant operations.
- Watch for
- Unexpected firewall reboots, crashes or traffic drops that could signal denial-of-service attempts.
- Repeated unusual requests to the firewall's internet-facing services.
- ATT&CK for ICS
- T0814Denial of Service
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CSA Singapore (opens csa.gov.sg)
More on Cisco