CVE-2018-0296
Confirmed PUBLISHEDA vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an...
Recommended Action
Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
At a Glance
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.
- CVE Published
- Jun 07, 2018
- Exploitation Reported
- Nov 03, 2021
- CVSS
- 7.5 High
- EPSS
- 99.9%
Affected Versions
| Vendor | Product | Version | Status |
|---|---|---|---|
| n/a |
Cisco Adaptive Security Appliance unknown
|
Cisco Adaptive Security Appliance unknown |
Affected |
CVE References
- 44956 exploit-db.com · Exploit https://www.exploit-db.com/exploits/44956/
- 104612 securityfocus.com · VDB Entry http://www.securityfocus.com/bid/104612
- 1041076 securitytracker.com · VDB Entry http://www.securitytracker.com/id/1041076
- ics-cert.us-cert.gov/advisories/ICSA-18-184-01 ics-cert.us-cert.gov · CVE Record https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01
- tools.cisco.com/security/center/content/CiscoSecurityAdvisor... tools.cisco.com · CVE Record https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory...
Show 1 more reference
- packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Applian... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-A...
Recommended Actions
- Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
- Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
- Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.
Known Exploited Vulnerability Sources
Catalogues that list this CVE as a known exploited vulnerability.
Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.
Learn about Pro API access| Source | Added |
|---|---|
| CISA First | 2021-11-03 00:00 UTC |
| The Shadowserver | 2026-06-15 00:00 UTC |
Scanner Artifacts
Nuclei and Metasploit references linked to this CVE.
| Scanner | Reference | Detected |
|---|---|---|
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-0296.yaml | Apr 25, 2025 |
Virtual Patch
Compensating WAF rules to help reduce exposure to this CVE. Rule content and deployable vendor exports are available with KEVIntel Enterprise.
KEVIntel does not currently have a virtual patch for this CVE. When available, KEVIntel virtual patches ship as deployable ModSecurity, Cloudflare, and AWS WAF rules.
Enterprise feature. Virtual patch rule content and deployable vendor exports (ModSecurity, Cloudflare, AWS WAF) are available to KEVIntel Enterprise users.
CVSS Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:N/AC:L/Au:N/C:N/I:N/A:P
Exploitation Status
Exploited in the wild
Recorded 2021-11-03 00:00:00 UTC · CISA
Proof of concept available
Recorded 2018-06-21 08:36:34 UTC · GitHub
Weaknesses (CWE)
-
Improper Input Validation
-
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Scanner Integrations
| Scanner | Reference | Detected |
|---|---|---|
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-0296.yaml | Apr 25, 2025 |
Potential Proof of Concepts
These PoCs are unverified and could contain malware. Use at your own risk.
github · Created 2018-12-19 11:57:43 UTC · 0 stars
https://github.com/milo2012/CVE-2018-0296.git
github · Created 2018-06-22 21:12:58 UTC · 1 stars
Cisco ASA - CVE-2018-0296 | Exploit
github · Created 2018-06-21 15:44:29 UTC · 203 stars
Script to test for Cisco ASA path traversal vulnerability (CVE-2018-0296) and extract system information.
github · Created 2018-06-21 08:36:34 UTC · 106 stars
Test CVE-2018-0296 and extract usernames
nuclei · Created Unknown
Timeline
Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.
-
00:00 UTC about 1 month ago00:00 UTC · about 1 month ago
KEV confirmed by The Shadowserver
Exploitation attested by an external source
-
00:00 UTC about 1 year ago00:00 UTC · about 1 year ago
Nuclei template available
Scanner coverage available
-
00:00 UTC over 4 years ago00:00 UTC · over 4 years ago
Added to CISA KEV
Listed in the CISA Known Exploited Vulnerabilities catalog
-
08:36 UTC about 8 years ago08:36 UTC · about 8 years ago
Public PoC available
Public proof-of-concept code published
-
12:00 UTC about 8 years ago12:00 UTC · about 8 years ago
CVE published
Vulnerability disclosed publicly
-
00:00 UTC over 8 years ago00:00 UTC · over 8 years ago
CVE ID reserved
Identifier reserved by the CNA
Automate This Intelligence with the Pro API
Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
Pro API Example
GET /api/v2/pro/kevs/CVE-2018-0296
{
"cve_id": "CVE-2018-0296",
"title": "A vulnerability in the web interface of the Cisco Adaptive Security Appliance...",
"affected_vendor": "Cisco",
"affected_product": "Cisco Adaptive Security Appliance unknown",
"affected_versions": [
{ "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
],
"confidence": "Confirmed",
"cvss_score": 7.5,
"epss_score": 0.99903,
"exploit_status": {
"exploited_in_the_wild": true,
"active_exploitation_observed": false
},
"sensor_telemetry": { "...": "Pro API fields" },
"proof_of_concepts": [ "..." ],
"scanner_integrations": [ "..." ]
}