Cisco WebVPN critical bug. Patch it now!


This vulnerability allows the attacker to see all of the data passing through the system and provides them with administrative privileges, enabling them to remotely gain access to the network behind it.


Note: This vulnerability can only be triggered if remote AnyConnect or WebVPN access is enabled, which is a common configuration for these firewalls. To determine whether webvpn is enabled for at least one interface, administrators can use the show running-config webvpn command at the CLI and verify that the command returns at least one enable <if_name> line.

The following example shows the output of the command for a device that is running Cisco ASA Software and has WebVPN enabled on the Outside interface.

Ciscozine#show running-config webvpn
enable Outside