Read the docs
TI-2018-00369 Aliases CVE-2018-0410GHSA-7vx9-5h56-f698

Uncontrolled resource consumption in Cisco AsyncOS Software for Cisco Web Security…

Priority MEDIUM 50CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-400.

Summary

A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service (DoS) condition on an affected system. The vulnerability exists because the affected software improperly manages memory resources for TCP connections to a targeted device. An attacker could exploit this vulnerability by establishing a high number of TCP connections to the data interface of an affected device via IPv4 or IPv6. A successful exploit could allow the attacker to exhaust system memory, which could cause the system to stop processing new connections and result in a DoS condition. System recovery may require manual intervention. Cisco Bug IDs: CSCvf36610.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04067 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoAsyncOS Software for Cisco Web Security Appliancesall versions—No fix listedCNA
  • AsyncOS Software for Cisco Web Security Appliances VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:cisco:web_security_appliance:9.1.1-074:*:*:*:*:*:*:*9.1.1-074VulnerableCisco
cpe:2.3:a:cisco:web_security_appliance:9.1.2-010:*:*:*:*:*:*:*9.1.2-010VulnerableCisco
cpe:2.3:a:cisco:web_security_appliance:9.1.2-022:*:*:*:*:*:*:*9.1.2-022VulnerableCisco
cpe:2.3:a:cisco:web_security_appliance:9.1.2-039:*:*:*:*:*:*:*9.1.2-039VulnerableCisco
cpe:2.3:a:cisco:web_security_appliance:10.1.0-204:*:*:*:*:*:*:*10.1.0-204VulnerableCisco
cpe:2.3:a:cisco:web_security_appliance:10.1.1-235:*:*:*:*:*:*:*10.1.1-235VulnerableCisco
cpe:2.3:a:cisco:web_security_appliance:10.5.1-270:*:*:*:*:*:*:*10.5.1-270VulnerableCisco
cpe:2.3:a:cisco:web_security_appliance:10.5.1-296:*:*:*:*:*:*:*10.5.1-296VulnerableCisco
cpe:2.3:a:cisco:web_security_appliance:10.5.2-042:*:*:*:*:*:*:*10.5.2-042VulnerableCisco
cpe:2.3:a:cisco:web_security_appliance:11.0.0-641:*:*:*:*:*:*:*11.0.0-641VulnerableCisco
  • cpe:2.3:a:cisco:web_security_appliance:9.1.1-074:*:*:*:*:*:*:* Versions 9.1.1-074 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:web_security_appliance:9.1.2-010:*:*:*:*:*:*:* Versions 9.1.2-010 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:web_security_appliance:9.1.2-022:*:*:*:*:*:*:* Versions 9.1.2-022 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:web_security_appliance:9.1.2-039:*:*:*:*:*:*:* Versions 9.1.2-039 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:web_security_appliance:10.1.0-204:*:*:*:*:*:*:* Versions 10.1.0-204 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:web_security_appliance:10.1.1-235:*:*:*:*:*:*:* Versions 10.1.1-235 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:web_security_appliance:10.5.1-270:*:*:*:*:*:*:* Versions 10.5.1-270 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:web_security_appliance:10.5.1-296:*:*:*:*:*:*:* Versions 10.5.1-296 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:web_security_appliance:10.5.2-042:*:*:*:*:*:*:* Versions 10.5.2-042 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:web_security_appliance:11.0.0-641:*:*:*:*:*:*:* Versions 11.0.0-641 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-0410
  2. 2026-10-03 Alias added: GHSA-7vx9-5h56-f698

References

Advisory 1

  • TI-2023-06741 Buffer overflow in Cisco Secure Web Appliance CVSS 3.1CRITICAL 9.8
  • TI-2019-01508 Cisco Web Security Appliance HTTPS Certificate Denial of Service Vulnerability CVSS 3.1HIGH 8.6
  • TI-2018-00312 A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance (WSA)… CVSS 3.0HIGH 7.5
  • TI-2021-01086 Cisco Web Security Appliance Privilege Escalation Vulnerability CVSS 3.1HIGH 8.8
  • TI-2019-11999 Cisco Web Security Appliance Unauthorized Device Reset Vulnerability CVSS 3.1HIGH 8.8
  • TI-2019-01440 Cisco Web Security Appliance Malformed Request Denial of Service Vulnerability CVSS 3.1HIGH 7.5
See all 64 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences