CVE-2018-0296

CVE-2018-0296 is a critical vulnerability affecting Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software, stemming from improper input validation in the web interface's HTTP URL. This flaw allows an unauthenticated, remote attacker to either trigger a denial of service (DoS) by causing the device to reload, or in some software versions, view sensitive system information through directory traversal. With a CVSS score of 7.5 (HIGH), the vulnerability is easily exploitable over the network with low complexity, requiring no user interaction, leading to high availability impact or potential information disclosure. This CVE is actively exploited in the wild, as confirmed by its presence in the KEV catalog and numerous exploit intelligence sources including Metasploit modules, Nuclei templates, and ExploitDB entries. The high EPSS score (0.9436) and FAUCET Risk Score (100/100) underscore its significant threat. Community discussion and media coverage highlight its widespread attention and ongoing exploitation, even years after the initial patch.