Cisco ASA/FTD WebVPN Double Free (CVE-2018-0101)

critical Tenable OT Security Plugin ID 505546

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. This vulnerability affects Cisco ASA Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, FTD Software (Version 6.2.2 only).

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Refer to the vendor advisory.

Plugin Details

Severity: Critical

ID: 505546

File Name: tenable_ot_cisco_CVE-2018-0101.nasl

Version: 1.1

Type: Remote

Family: Tenable.ot

Published: 7/20/2026

Updated: 7/20/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 99.1

CVSS v3

Risk Factor: Critical

Base Score: 10

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/o:cisco:adaptive_security_appliance_software, cpe:/o:cisco:firepower_threat_defense

Required KB Items: Tenable.ot/Cisco

Patch Publication Date: 1/29/2018

Vulnerability Publication Date: 1/29/2018

Reference Information

CVE: CVE-2018-0101

CWE: 415

Detections

Analytics