CISCO ASA Vulnerability goes wild

Hackers are scanning for and actively exploiting a vulnerability in Cisco ASA devices after a PoC exploit was published tracked as CVE-2020-3580. Is a Cisco ASA vulnerability is cross-site scripting (XSS) vulnerability issue was disclosed and fixed Iast year but its incomplete and a new fix was released this year.

A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information.

After a vulnerability has been fixed and enough time has been given for devices to be upgraded, security researchers commonly publish proof-of-concept (PoC) exploits to share how organizations detect and prevent associated attacks.

The released exploit will display a JavaScript alert in the user’s browser when they visit a specially crafted malicious webpage. However, the malicious webpage could have executed other JavaScript commands to perform malicious activity.

Soon after the PoC was released, Tenable reported that threat actors are actively exploiting the vulnerability on affected devices but did not disclose what malicious activity was being performed.

As threat actors are now actively exploiting the vulnerability, it is crucial for administrators to immediately patch vulnerable Cisco ASA devices so threat actors cannot exploit them.