Zero Day Threat - Cisco Remote Access on ASA/FTD

Thu, 25 Apr 2024 00:00:00 +0000

Cisco recently patched two critical vulnerabilities in their firewall products, discovered after probable nation-state actors targeted them in a campaign dubbed "Arcane Door". These zero-day vulnerabilities, found in devices running ASA and FTD software, were exploited to implant malware and possibly steal data. Cisco released three patches and has tracked the hacking group under UAT4356 and STORM-1849 by Microsoft. These flaws, involving HTTP header parsing and a legacy VPN client preloading capability, allowed attackers root-level access, emphasizing the need for immediate patching and security upgrades.

FTD on Thoughts and Ramblings by Mike

Zero Day Threat - Cisco Remote Access on ASA/FTD