Vulnerability record · CVE-2018-0101 · published 29 January 2018
CVE-2018-0101: Cisco ASA WebVPN double free allows unauthenticated remote code execution
Cisco · Adaptive Security Appliance Software
Cisco ASA Software contains a double free in the SSL VPN (webvpn) feature, triggered when crafted XML packets are sent to a webvpn-enabled interface. Because the flaw is reachable without authentication and can lead to code execution or a device reload, it is a severe risk to any internet-facing ASA or FTD device with webvpn enabled.
Description
A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. This vulnerability affects Cisco ASA Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, Firepower Threat Defense Software (FTD). Cisco Bug IDs: CSCvg35618.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 10.0 with no authentication or user interaction, public exploit code and a very high EPSS score make this an urgent patch for any exposed webvpn-enabled ASA or FTD.
What it is
Cisco ASA Software contains a double free in the SSL VPN (webvpn) feature, triggered when crafted XML packets are sent to a webvpn-enabled interface. Because the flaw is reachable without authentication and can lead to code execution or a device reload, it is a severe risk to any internet-facing ASA or FTD device with webvpn enabled.
Impact
An unauthenticated remote attacker can execute arbitrary code with full control of the appliance, or force a reload that disrupts all traffic through it. Full device compromise can expose VPN credentials, configurations and traffic handled by the firewall.
Attack surface
Reached over the network via the webvpn interface; the CVSS vector shows no privileges and no user interaction required. Only devices with the webvpn feature enabled are exposed.
Exploitation
Public exploit code is referenced (Exploit-DB 43986 and a Pastebin entry), and EPSS is very high at 0.8678 (99.7th percentile), though the CVE is not listed in CISA KEV.
What to do
- Apply the Cisco ASA/FTD software update from advisory cisco-sa-20180129-asa1 immediately.
- If patching cannot be done at once, disable the webvpn feature on internet-facing interfaces.
- Restrict management and VPN access to trusted source addresses where operationally possible.
- Monitor ASA/FTD for unexpected reloads and treat them as possible exploitation attempts.
- Review ASA/FTD configurations and logs for signs of compromise after any exposure window.
Detection
- Alert on unexpected ASA/FTD reloads or crash/restart events, especially on webvpn-enabled devices.
- Inspect webvpn/HTTPS traffic for malformed or anomalous XML POST bodies targeting the VPN interface.
- Correlate IDS/IPS signatures for CVE-2018-0101 with ASA/FTD syslog events.
- Hunt for post-exploitation indicators such as new local accounts, config changes or outbound connections from the appliance.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2018-0101 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-0101), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
