A zero-day RCE in Cisco ADSM has yet to be fixed

A remote code execution (RCE) vulnerability in the Cisco Adaptive Security Device Manager (ADSM) Launcher disclosed in July has yet to be addressed.

Cisco provided an update on a remote code execution (RCE) vulnerability (CVE-2021-1585) in the Adaptive Security Device Manager (ADSM) Launcher, the IT giant confirmed that the flaw has yet to be addressed.

Cisco Adaptive Security Device Manager (ASDM) provided a local, web-based interface to allow customers to manage Cisco Adaptive Security Appliance (ASA) firewalls and the Cisco AnyConnect Secure Mobility clients.

The vulnerability affects ADSM software versions from releases ‘9.16.1 and earlier.

“A vulnerability in the Cisco Adaptive Security Device Manager (ASDM) Launcher could allow an unauthenticated, remote attacker to execute arbitrary code on a user’s operating system.

This vulnerability is due to a lack of proper signature verification for specific code exchanged between the ASDM and the Launcher. An attacker could exploit this vulnerability by leveraging a man-in-the-middle position on the network to intercept the traffic between the Launcher and the ASDM and then inject arbitrary code.” reads the initial advisory. “A successful exploit could allow the attacker to execute arbitrary code on the user’s operating system with the level of privileges assigned to the ASDM Launcher. A successful exploit may require the attacker to perform a social engineering attack to persuade the user to initiate communication from the Launcher to the ASDM.”

Cisco confirmed that it plans to address this vulnerability and that there are no workarounds that fix the issue.

The good new is that the Cisco Product Security Incident Response Team (PSIRT) is not aware of the public availability of proof-of-concept exploits for this flaw or attacks exploiting it in the wild.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Cisco ASDM)