{"id":"CVE-2018-0296","published":"2018-06-07T12:29:00Z","modified":"2026-08-11T19:37:30Z","title":"Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability","vendor":"Cisco","product":"Adaptive Security Appliance (ASA)","tier":"core","eol":null,"description":{"text":"A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the web interface of Cisco Adaptive Security Appliance (ASA) software, caused by improper input validation of HTTP URLs, affects ASA and Firepower Threat Defense (FTD) software running on a range of Cisco firewall and security appliance models. An unauthenticated remote attacker can exploit it by sending a crafted HTTP request over IPv4 or IPv6 to an affected device, with no authentication and no user interaction required, to cause an unexpected reload (denial of service) or, on certain software releases, use directory traversal to view sensitive system information.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:00Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99898,"percentile":0.99966,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-0296","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-04-17","exploitedFirstSeen":"2019-04-17","ransomware":false,"evidence":[{"url":"https://blog.talosintelligence.com/2019/04/seaturtle.html","date":"2019-04-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2018-0296","date":"2023-11-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-27&host_type=src&vulnerability=cve-2018-0296","date":"2023-11-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-29&host_type=src&vulnerability=cve-2018-0296","date":"2023-11-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-11&host_type=src&vulnerability=cve-2018-0296","date":"2023-12-11"},{"url":"https://25491742.fs1.hubspotusercontent-eu1.net/hubfs/25491742/WAZAWAKA_TLPCLEAR_Report.pdf","date":"2023-12-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-21&host_type=src&vulnerability=cve-2018-0296","date":"2023-12-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-22&host_type=src&vulnerability=cve-2018-0296","date":"2023-12-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-03&host_type=src&vulnerability=cve-2018-0296","date":"2024-01-03"}],"evidenceTotal":429,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/104612","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1041076","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd","tags":["Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/44956/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/104612","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1041076","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd","tags":["Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/44956/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0296","tags":["US Government Resource"]}],"techniques":[{"id":"T1202","name":"Indirect Command Execution","tactics":["stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Denial of Service","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2018-0296 is a critical vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software. This vulnerability allows an unauthenticated, remote attacker to perform directory traversal attacks and access sensitive system information.","confidence":"low","confidenceNote":"Windows-only technique on a non-Windows product"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Denial of Service","mappingType":"primary_impact","evidence":[],"comment":"CVE-2018-0296 is a critical vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software. This vulnerability allows an unauthenticated, remote attacker to perform directory traversal attacks and access sensitive system information.","confidence":"high"}],"reports":[{"id":"SRC-65ab06ae92274f14e50e","title":"DNS Hijacking Abuses Trust In Core Internet Service","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/seaturtle/","date":"2019-04-17","mentions":[{"quote":"CVE-2018-0296: Directory traversal allowing unauthorized access to Cisco Adaptive Security Appliances (ASAs) and firewalls","start":8972,"end":9094},{"quote":"Code Exploit (RCE) for Cisco integrated Service Router 2811SID: 43424 - 43432CVE-2017-12617: RCE affecting Apache web servers running TomcatSID: 44531CVE-2018-0296: Directory traversal to gain unauthorized access to Cisco Adaptive Security Appliances (ASAs) and FirewallsSID: 46897CVE-2018-7600: RCE for Website","start":20356,"end":20667}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-1119","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-1119","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":44956,"url":"https://www.exploit-db.com/exploits/44956","title":"Cisco Adaptive Security Appliance - Path Traversal","type":"webapps","platform":"hardware","date":"2018-06-28","verified":false,"provenance":"source"},{"id":47220,"url":"https://www.exploit-db.com/exploits/47220","title":"Cisco Adaptive Security Appliance - Path Traversal (Metasploit)","type":"webapps","platform":"hardware","date":"2019-08-12","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2018-06-28"},"pocGithub":{"count":4,"skipped":0,"earliest":"2018-06-21","earliestUrl":"https://github.com/milo2012/CVE-2018-0296","repos":[{"name":"yassineaboukir/CVE-2018-0296","url":"https://github.com/yassineaboukir/CVE-2018-0296","stars":205,"created":"2018-06-21"},{"name":"milo2012/CVE-2018-0296","url":"https://github.com/milo2012/CVE-2018-0296","stars":106,"created":"2018-06-21"},{"name":"bhenner1/CVE-2018-0296","url":"https://github.com/bhenner1/CVE-2018-0296","stars":1,"created":"2018-06-22"},{"name":"qiantu88/CVE-2018-0296","url":"https://github.com/qiantu88/CVE-2018-0296","stars":0,"created":"2018-12-19"}]},"metasploit":[{"name":"Cisco ASA Directory Traversal","module":"auxiliary/scanner/http/cisco_directory_traversal","type":"auxiliary","disclosureDate":"2018-06-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/cisco_directory_traversal.rb"}],"nuclei":[{"id":"CVE-2018-0296","name":"Cisco ASA - Local File Inclusion","severity":"high","path":"http/cves/2018/CVE-2018-0296.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-0296.yaml"}],"first":{"date":"2018-06-06","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/cisco_directory_traversal.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html","https://www.exploit-db.com/exploits/44956/"],"flow":[{"stage":"primary","techniques":["T1005"],"provenance":"source"},{"stage":"related","techniques":["T1202"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2018-06-06","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2018-06-21, Exploit-DB 2018-06-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/cisco_directory_traversal.rb","provenance":"source"},{"date":"2018-06-07","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0296","provenance":"source"},{"date":"2019-04-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.talosintelligence.com/2019/04/seaturtle.html","provenance":"source"},{"date":"2019-04-17","kind":"report","label":"Named in blog.talosintelligence.com: DNS Hijacking Abuses Trust In Core Internet Service","url":"https://blog.talosintelligence.com/seaturtle/","provenance":"machine"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-1119","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1245},"priority":{"score":72.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2752 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 4 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-cisco-asa-cwe-20"}}