CVE-2021-40118
📋 TL;DR
An unauthenticated remote attacker can send a malicious HTTPS request to Cisco ASA/FTD devices to trigger a denial of service condition, causing the device to reload. This affects Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software with vulnerable web services interface configurations.
💻 Affected Systems
- Cisco Adaptive Security Appliance (ASA) Software
- Cisco Firepower Threat Defense (FTD) Software
📦 What is this software?
Adaptive Security Appliance Software by Cisco
View all CVEs affecting Adaptive Security Appliance Software →
Adaptive Security Appliance Software by Cisco
View all CVEs affecting Adaptive Security Appliance Software →
Adaptive Security Appliance Software by Cisco
View all CVEs affecting Adaptive Security Appliance Software →
⚠️ Risk & Real-World Impact
Worst Case
Complete network outage as firewall reloads, disrupting all traffic passing through the device during reload period.
Likely Case
Temporary service disruption lasting 1-5 minutes during device reload, potentially causing dropped connections and brief network unavailability.
If Mitigated
No impact if device is patched or workarounds are properly implemented.
🎯 Exploit Status
Simple HTTPS request manipulation required. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Multiple fixed releases - see Cisco advisory for specific versions
Vendor Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asafdt-webvpn-dos-KSqJAKPA
Restart Required: Yes
Instructions:
1. Check current ASA/FTD version. 2. Download appropriate fixed release from Cisco. 3. Apply update following Cisco upgrade procedures. 4. Reboot device to complete installation.
🔧 Temporary Workarounds
Disable WebVPN/AnyConnect
allDisable the vulnerable web services interface if not required
no webvpn enable
no anyconnect enable
Restrict Access with ACLs
allApply access control lists to limit HTTPS access to trusted sources only
access-list WEBVPN-ACL extended permit tcp trusted-networks any eq 443
access-group WEBVPN-ACL in interface outside
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable devices
- Deploy intrusion prevention systems to detect and block exploit attempts
🔍 How to Verify
Check if Vulnerable:
Check if WebVPN or AnyConnect is enabled: 'show running-config | include webvpn|anyconnect'Check Version:
show version | include VersionVerify Fix Applied:
Verify running version is patched: 'show version' and compare to fixed releases in advisory📡 Detection & Monitoring
Log Indicators:
- Unexpected device reloads
- WebVPN/AnyConnect service crashes
- Multiple malformed HTTPS requests
Network Indicators:
- Spike in HTTPS traffic to firewall on port 443
- Unusual request patterns to WebVPN interface
SIEM Query:
source="asa.log" AND ("Reloading" OR "webvpn" OR "anyconnect") AND severity=ERROR