“We’ve demonstrated that a man-in-the-middle or evil endpoint can still execute arbitrary code by attacking ASDM,” Jake Baines, lead security researcher at Rapid7, said via email. Essentially, ASA can be treated as a “Trojan horse” to launch attacks. Rapid7 said the overarching point of the research they’ve conducted on Cisco highlights the risk of a malicious actor using ASA to hide or embed malicious code to gain further access into a targeted network. Researchers also say very few users are deploying the patches that work, leaving a large number of users still vulnerable to attack.Ĭisco has more than 300,000 customers using its security products and more than 1 million ASA devices are deployed around the world. However, CVE-2021-1585 can still be exploited by attackers clicking through a pop-up window, Rapid7 said. Rapid7 researchers confirmed that CVE-2022-20829 was successfully resolved.Cisco told Rapid7 researchers that it had resolved outstanding issues with CVE-2021-1585 and CVE-2022-20829. Earlier this month, in a presentation at Black Hat USA, Rapid7 researchers reported multiple vulnerabilities in Cisco Adaptive Security Software, ASDM and Firepower Services Software for ASA, which were left unpatched for months.

A large percentage of customers have failed to implement other recent security updates, Rapid7 said.

Researchers from Rapid7 claim malicious actors can still exploit a vulnerability in Cisco firewall software using man-in-the-middle attacks because a patch issued by the company is not working as promised.