ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices
Note that the use of this field does not indicate the exploitation of CVE-2018-0101 which was NOT used as a component of this campaign.
CVE-2018-0101 Public exploit EPSS 86.8%
A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA)…
Summary
A double-free flaw in the SSL VPN (WebVPN) functionality of Cisco Adaptive Security Appliance (ASA) Software, present on ASA 5500 and 5500-X Series, Firepower 2100/4110/9300 ASA modules, Firepower Threat Defense, and other listed Cisco platforms, occurs when the webvpn feature is enabled. An unauthenticated remote attacker who can send crafted XML packets to a webvpn-configured interface can cause the device to reload or execute arbitrary code and gain full control of the system.
Official description · CVE.org
A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. This vulnerability affects Cisco ASA Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, Firepower Threat Defense Software (FTD). Cisco Bug IDs: CSCvg35618.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
64.9 / 100
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 1
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited the day it was disclosed. Public exploit code (Exploit-DB) appeared 9 days after disclosure.
- Public exploit codeExploit-DB+9 days
- Named in a threat reportblog.talosintelligence.com+6 yrs
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo high- or medium-confidence techniques. The 1 available link are lower confidence and listed below.
Lower-confidence links (1)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Exploit Public-Facing ApplicationT1190 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
What security researchers reported
Named in 1 threat report1 reportCisco TalosApr 2024
Reports are matched by finding the exact id CVE-2018-0101 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Also mentioned in 2 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- CVE Data16 Feb 2026
- New espionage-focused campaign found targeting perimeter network devices24 Apr 2024