Cyber Resilience

CVE-2018-0101

Memory Safety in Cisco Adaptive Security Appliance Software ≤ 9.1.7.23

Public PoCHigh EPSSMemory Safety
Published
29 January 2018
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3 10.0
Click a component to see what it means
Raw vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.87 99.7th percentile
Risk Priority 100 floored blend · peak EPSS

Summary

CVE-2018-0101 is a critical-severity Double Free (CWE-415) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 10.0 (Critical).

Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is…

more

due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. This vulnerability affects Cisco ASA Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, Firepower Threat Defense Software (FTD). Cisco Bug IDs: CSCvg35618.

CWE(s)
CWE-415

Related Threats

Threat-Actor AttributionAI

ArcaneDoor (C0046)
ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The CVE is an unauthenticated remote code execution vulnerability in a public-facing SSL VPN interface.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Successful exploitation grants full system control, enabling privilege escalation from the network context.
attack.mitre.org →
T1059 Command and Scripting Interpreter Executionconfidence: MEDIUM
Arbitrary code execution on the appliance can be used to run commands or scripts via the compromised device.
attack.mitre.org →
inferred from description + CWE + attributed actor TTPs (ArcaneDoor) · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-20070Same product: Cisco Adaptive Security Appliance Software
CVE-2018-0296Same product: Cisco Adaptive Security Appliance Software
CVE-2026-20073Same product: Cisco Adaptive Security Appliance Software
CVE-2024-20494Same product: Cisco Adaptive Security Appliance Software
CVE-2024-20384Same product: Cisco Adaptive Security Appliance Software
CVE-2025-20333Same product: Cisco Adaptive Security Appliance Software
CVE-2020-3580Same product: Cisco Adaptive Security Appliance Software
CVE-2024-20353Same product: Cisco Adaptive Security Appliance Software
CVE-2024-20355Same product: Cisco Adaptive Security Appliance Software
CVE-2023-20275Same product: Cisco Adaptive Security Appliance Software

Affected Assets

cisco
adaptive security appliance software
≤ 9.1.7.23 · 9.2.0 — 9.2.4.27 · 9.3.0 — 9.4.4.16
cisco
firepower threat defense
6.0.0, 6.0.1, 6.1.0, 6.2.0, 6.2.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices directly prevent double-free errors via static analysis, safe memory APIs, and testing.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development can detect double-free conditions before release.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle includes memory-safety practices that can prevent double-free bugs.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate memory-safety rules that reduce double-free risk.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure system architecture and engineering principles can prescribe safe memory-management patterns.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly address proper use of free() and similar functions.

References