A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating system of an affected device. The vulnerability is due to insufficient restrictions on the allowed Lua function calls within the context of user-supplied Lua scripts. A successful exploit could allow the attacker to trigger a heap overflow condition and execute arbitrary code with root privileges on the underlying Linux operating system of an affected device.

According to its self-reported VDB version, Cisco Firepower Management Center is affected by a remote code execution vulnerability. An attacker with valid administrative credentials can configure an Advanced Detector on the FMC web interface and submit a malicious Lua script which, when pushed to a vulnerable managed FTD device, will escape the scripting sandbox and execute arbitrary code with root privileges on the underlying Linux operating system of the FTD device.

Please see the included Cisco BIDs and Cisco Security Advisory for more information

A remote code execution vulnerability exists in the Lua interpreter of Cisco Firepower Threat Defense (FTD) software due to insufficient restrictions on the allowed Lua function calls within the context of user-supplied Lua scripts. An authenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges on the underlying Linux operating system of an affected device.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A remote code execution vulnerability exists in the Lua interpreter of Cisco Adaptive Security Appliance (ASA) software due to insufficient restrictions on the allowed Lua function calls within the context of user-supplied Lua scripts. An authenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges on the underlying Linux operating system of an affected device.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
136719	Cisco Firepower Management Center RCE (cisco-sa-20191112-asa-ftd-lua-rce)	Nessus	CISCO	high
131229	Cisco Firepower Threat Defense RCE (cisco-sa-20191112-asa-ftd-lua-rce)	Nessus	CISCO	high
131228	Cisco Adaptive Security Appliance RCE (cisco-sa-20191112-asa-ftd-lua-rce)	Nessus	CISCO	high

Detections

Analytics

CVE-2019-15992

high

Tenable Plugins

high

high

high