“We’ve demonstrated that a man-in-the-middle or evil endpoint can still execute arbitrary code by attacking ASDM,” Jake Baines, lead security researcher at Rapid7, said via email. Essentially, ASA can be treated as a “Trojan horse” to launch attacks. Rapid7 said the overarching point of the research they’ve conducted on Cisco highlights the risk of a malicious actor using ASA to hide or embed malicious code to gain further access into a targeted network.

Researchers also say very few users are deploying the patches that work, leaving a large number of users still vulnerable to attack.Ĭisco has more than 300,000 customers using its security products and more than 1 million ASA devices are deployed around the world. However, CVE-2021-1585 can still be exploited by attackers clicking through a pop-up window, Rapid7 said.

Rapid7 researchers confirmed that CVE-2022-20829 was successfully resolved.Cisco told Rapid7 researchers that it had resolved outstanding issues with CVE-2021-1585 and CVE-2022-20829. Earlier this month, in a presentation at Black Hat USA, Rapid7 researchers reported multiple vulnerabilities in Cisco Adaptive Security Software, ASDM and Firepower Services Software for ASA, which were left unpatched for months.A large percentage of customers have failed to implement other recent security updates, Rapid7 said. Researchers from Rapid7 claim malicious actors can still exploit a vulnerability in Cisco firewall software using man-in-the-middle attacks because a patch issued by the company is not working as promised.