CVE-2021-1445: 
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation

CVE-2021-1445 is a vulnerability affecting Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software. The vulnerability was disclosed on April 28, 2021, and affects devices configured for termination of AnyConnect VPN Client connections. This vulnerability is part of a bundle of security advisories released by Cisco with a High Security Impact Rating (SIR) and a CVSS Base Score of 8.6 (Cisco Advisory).

The vulnerability is due to lack of proper input validation of HTTPS requests in the affected systems. It specifically impacts AnyConnect IKEv2 Remote Access (with client services) and AnyConnect SSL VPN configurations. The vulnerability has been assigned a CVSS Base Score of 8.6 with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X (Cisco Advisory).

A successful exploitation of this vulnerability could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The attack could result in the affected device reloading, leading to service disruption (Cisco Advisory).

The vulnerability can be exploited by sending a crafted HTTPS request to an affected device. No authentication is required for exploitation. As of the advisory publication, Cisco PSIRT was not aware of any public announcements or malicious use of this vulnerability (Cisco Advisory).

Cisco has released software updates that address this vulnerability. There are no workarounds available. For ASA Software, fixed versions include 9.8.4.35, 9.9.2.85, 9.12.4.18, 9.13.1.21, 9.14.2.13, and 9.15.1.15. For FTD Software, fixed versions include 6.4.0.12, 6.6.4, and 6.7.0.2 (Cisco Advisory).