思科应用服务引擎未经授权访问漏洞

该漏洞的影响非常严重，攻击者可以利用这些漏洞完全控制受影响的思科 Application Services Engine 设备。攻击者可以执行任意代码，访问敏感数据，甚至可能在网络中进行横向移动。由于该漏洞允许未经验证的攻击者获得特权，因此攻击者可以绕过现有的安全控制，从而造成严重的损害。攻击者可以利用这些漏洞窃取敏感信息，例如用户凭据、财务数据和知识产权。此外，攻击者还可以利用这些漏洞破坏设备，导致服务中断和数据丢失。

Organizations heavily reliant on Cisco Application Services Engine for critical network functions are at significant risk. Specifically, deployments with limited network segmentation or weak access controls are particularly vulnerable. Environments with older, unpatched versions of the Application Services Engine are also at increased risk, as they lack the security fixes included in later releases.

• cisco: Monitor Cisco Application Services Engine logs for unusual activity, particularly attempts to access diagnostic or configuration endpoints.

# Example: Check for suspicious requests in the access logs
grep -i "/api/diagnostics" /var/log/cisco/ase/access.log

• generic web: Use curl to probe for exposed diagnostic or configuration endpoints.

curl -v http://<ASE_IP>/api/diagnostics

• generic web: Monitor access and error logs for requests containing suspicious payloads or patterns indicative of RCE attempts.

grep -i "system()" /var/log/apache2/access.log

1. 2021-02-24Disclosure

   disclosure

1. 已保留2020-11-13
2. 发布日期2021-02-24
3. 修改日期2024-11-08
4. EPSS 更新日期2026-04-02

由于受影响版本为 n/a，目前没有官方的修复版本可用。建议用户立即采取缓解措施，以降低风险。可以考虑实施以下缓解措施：限制对 Application Services Engine 设备的访问，使用强密码和多因素身份验证，并定期审查安全配置。此外，可以考虑使用 Web 应用程序防火墙 (WAF) 或反向代理来过滤恶意流量。监控 Application Services Engine 设备的日志，以检测任何可疑活动。在升级到修复版本之前，请务必备份配置，并测试升级过程，以确保不会对现有系统造成影响。