QID 317172

A vulnerability in the web services interface for remote access VPN features of
Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15.

Affected Products
Cisco products if they are running a vulnerable release of Cisco ASA Software and at least one of following conditions is true:
HTTPS Management Access and IKEv2 Client Services are both enabled on at least one (not necessarily the same) interface
HTTPS Management Access and WebVPN are both enabled on at least one (not necessarily the same) interface
Vulnerable Versions:
Earlier than 9.8.4.43
From 9.9 Prior to 9.12.4.38
From 9.13 Prior to 9.14.4
From 9.15 Prior to 9.15.1.21
From 9.16 Prior to 9.16.2.13
From 9.17 Prior to 9.17.1.7

QID Detection Logic (Authenticated):
The check matches Cisco ASA OS version retrieved via Unix Auth using "version" command.

A successful exploit could allow the attacker to gain privilege level 15 access to the web management interface of the device.