Cisco Firepower Threat Defense Software Nonstandard Protocol Detection Bypass Vulnerability

Vulnerability

The vulnerability resides in the protocol detection component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software [1]. The flaw is due to improper detection of the initial use of a protocol on a nonstandard port [1]. At the time of publication, all releases of the affected products were vulnerable [1].

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability by sending traffic on a nonstandard port for the protocol in use through an affected device [1]. The attacker does not require authentication or prior access to the target network [1]. The initial flow on the nonstandard port bypasses filtering, allowing subsequent malicious requests to be delivered past the device [1].

Impact

Successful exploitation allows the attacker to bypass filtering protections and deliver malicious requests to protected systems that would otherwise be blocked [1]. This could lead to information disclosure or further compromise of the protected systems, depending on the nature of the delivered payload [1].

Mitigation

As of the advisory publication date (2019-08-16), no workarounds were available [1]. Cisco advised customers to consult the advisory for fixed software releases in the Fixed Software section [1]. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog based on available information.