top of page

DOS vulnerability on Cisco Firewalls (ASA, FTD)

And Yet Another Weekend Post! (YAWP)

Attackers are actively exploiting a vulnerability in the Cisco's Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. CVE-2018-15454 describes a vulnerability in the Session Initiation Protocol (SIP) inspection engine of ASA and FTD . If the exploit is successful, the security breach allows a remote attacker to deploy a denial of service (DoS) condition by reloading or triggering high CPU cycles.Caused by improper handling of SIP traffic, the flaw could allow bad actors to send SIP requests designed to specifically trigger the issue at a high rate across an affected device.

In fact the vulnerability itself isn NOT too dangerous, but affected customers can nevertheless experience some downtime, with devices crashing and reloading.The vulnerability is present in Cisco ASA Software Release 9.4 and later and Cisco FTD Software Release 6.0 and later.

The following Cisco products running the software with SIP inspection enabled are confirmed as “affected:

  • Firepower 2100 Series Security Appliance

  • Firepower 4100 Series Security Appliance

  • Firepower 9300 ASA Security Module

  • 3000 Series Industrial Security Appliance (ISA)

  • ASA 5500-X Series Next-Generation Firewalls

  • ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers

  • Adaptive Security Virtual Appliance (ASAv)

  • FTD virtual (FTDv)

More worryingly, the vulnerability is actively being exploited in the wild.

IOC_Indicators of Compromise

Access your #Cisco_Firewall first, if the output of show conn port 5060 shows a large number of incomplete SIP connections


the output of show processes cpu-usage non-zero sorted shows a high CPU utilization. Then, you are in a HUGE DISASTER !!! 😈

Successful exploitation of this vulnerability can also result in the affected device crashing and reloading. After the device boots up again, the output of show crashinfo will show an unknown abort of the DATAPATH thread.

How to fix and/or mitigate this issue ?!

  • Option 1: Disable SIP Inspection

In Cisco ASA:

policy-map global_policy

class inspection_default

no inspect sip

In Cisco FTD:

configure inspection sip disable

  • Option 2: Block the Offending Host(s)

After applying the ACL, make sure to clear existing connections for that source using the clear conn address <ip_address> command in EXEC mode.Alternatively, the offending host can be shunned using the shun <ip_address> command in EXEC mode

  • Option 3: Filter on Sent-by Address of

regex VIAHEADER ""

policy-map type inspect sip P1


match message-path regex VIAHEADER


policy-map global_policy

class inspection_default

no inspect sip

inspect sip P1

  • Option 4: Rate Limit SIP Traffic

Rate limitimg using (MPF)

Some of our CybeJumper users asked us to introduce a workaround for accessing ASDM in Win10. They tried to connect to ASDM and got the following error:

How can you fix this?!

So simple! Easy peasy !

Go the properties of the ASDM shortcut, and look at the ‘Target‘ value and change it to the following

C:\Windows\system32\wscript.exe invisible.vbs run.bat

Apply > OK.

There you go! Now you can access ASDM!


All product names, logos, and brands are the property of their respective owners in Austria or other countries. All company, product and service names used on this website are for identification purposes only. Pheniix is not affiliated with or an official partner of Cisco, CompTIA,Dimension Data, VMware, Amazon, Microsoft, Certified Ethical Hacker, (ISC)², Juniper, Wireshark, Offensive Security,Google, GNS3, F5, Python, Linux, Java, OpenStack, Vagrant, Ansible, Docker, GIT, , Blockchain or other companies. Use of these names, logos, and brands does not imply endorsement. The opinions expressed on pheniix are personal perspectives and not those of Cisco, Dimension Data or any other company. Pheniix runs as an independent blog.

bottom of page