Cisco’s VPN flaw can restart the firewall

This is It's probably nothing for 30 October. Today: Cisco VPN exploitation, PHP2Shell’s root stage, and two Juniper flaws with different exposure boundaries.

Cisco says a flaw in ASA and FTD appliances is being actively exploited. A crafted connection request can make a vulnerable appliance reload, without a successful VPN login. But the configuration matters: exposure requires a reachable SSL remote-access VPN service with secondary authentication in an applicable tunnel group.

There’s an awkward detail here. Removing the tunnel-group list doesn’t remove exposure if DefaultWEBVPNGroup still uses secondary authentication. Removing a menu isn’t the same as removing the vulnerable path.

The disclosed impact is denial of service, not code execution or data theft. Cisco says it became aware of exploitation during October, but hasn’t named attackers, victims or the scale.

If you’re running that configuration, Cisco’s branch-specific fix table is worth checking. Fixes are available. The configuration-dependent mitigations can alter VPN functionality or weaken authentication, so they’re not an equivalent substitute.

Next, CISA has added the Linux kernel privilege-escalation flaw used in PHP2Shell chains to its known-exploited catalogue. CISA explicitly links it to chains that implant webshells and run commands as root. This isn’t another notice about the two PHP bugs: the newly listed component is the privilege-escalation stage.

For context, Dream’s 26 October report attributed 24 compromised perimeter firewalls and one internal firewall-management server to the chain. In the implementation Dream recovered, the PHP stage ran as the nobody account. Fragnesia then modified page-cache-backed PAM configuration to permit root access. Dream withheld the vendor and affected versions, so those findings don’t identify a particular firewall product.

CISA’s new entry requires forensic triage and sets a 31 October remediation deadline for covered federal agencies. The question extends beyond whether PHP is patched to whether the appliance was rooted.

Finally, Juniper’s two root paths have different boundaries. Juniper says one flaw lets an unauthenticated remote attacker execute commands as root on Session Smart Conductor, through a specially crafted salt minion ID handled by AutomatedProvisioner.

The second allows unauthenticated administrative access through crafted URL parameters on Session Smart Router, but only before the device is onboarded to Mist or Conductor. That’s a meaningful restriction, not a footnote. It doesn’t describe exposure across an already-onboarded router fleet.

The corresponding fixed releases are 7.0.5, 7.1.7 and 7.2.3. Juniper lists no workaround for either flaw and says it isn’t aware of malicious exploitation. The Conductor root-command path is substantial enough without borrowing urgency from attacks the vendor hasn’t reported.

That’s it for this edition. Catch you next time.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.