Security audit

cisco-asa-syslog

Security checks for vulnerabilities and agentic risk

Overview

This is a Cisco ASA syslog reference skill made of Markdown documentation, with scanner alerts caused by firewall log text and support guidance rather than hidden code or unsafe behavior.

Installers should treat this as a documentation/reference skill. When following Cisco TAC guidance, sanitize ASA configurations, support archives, logs, tokens, usernames, IPs, and topology details before sharing them externally, and have an administrator review any firewall configuration commands before applying them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (124)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Messages Listed by Severity Level.md (reported line 268)May include surrounding context.
md
- %ASA-2-105508: (Primary|Secondary) Error creating failover connection socket for port _port_\\n - %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Messages Listed by Severity Level.md (reported line 276)May include surrounding context.
md
- %ASA-2-105508: (Primary|Secondary) Error creating failover connection socket for port _port_\\n - %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Syslog Messages 101001 to 199027.md (reported line 732)May include surrounding context.
md
- %ASA-2-105508: (Primary|Secondary) Error creating failover connection socket for port _port_\\n - %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Syslog Messages 101001 to 199027.md (reported line 734)May include surrounding context.
md
- %ASA-2-105508: (Primary|Secondary) Error creating failover connection socket for port _port_\\n - %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Syslog Messages 101001 to 199027.md (reported line 742)May include surrounding context.
md
- %ASA-2-105508: (Primary|Secondary) Error creating failover connection socket for port _port_\\n - %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Syslog Messages 101001 to 199027.md (reported line 756)May include surrounding context.
md
- %ASA-2-105508: (Primary|Secondary) Error creating failover connection socket for port _port_\\n - %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Syslog Messages 101001 to 199027.md (reported line 764)May include surrounding context.
md
- %ASA-2-105508: (Primary|Secondary) Error creating failover connection socket for port _port_\\n - %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Syslog Messages 101001 to 199027.md (reported line 822)May include surrounding context.
md
- %ASA-2-105508: (Primary|Secondary) Error creating failover connection socket for port _port_\\n - %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Syslog Messages 101001 to 199027.md (reported line 824)May include surrounding context.
md
- %ASA-2-105508: (Primary|Secondary) Error creating failover connection socket for port _port_\\n - %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Messages Listed by Severity Level.md (reported line 270)May include surrounding context.
md
- %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_) - %ASA-2-105527: (Primary|Secondary) Failure reading response to access token request

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Messages Listed by Severity Level.md (reported line 272)May include surrounding context.
md
- %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_) - %ASA-2-105527: (Primary|Secondary) Failure reading response to access token request

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Messages Listed by Severity Level.md (reported line 274)May include surrounding context.
md
- %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_) - %ASA-2-105527: (Primary|Secondary) Failure reading response to access token request

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Messages Listed by Severity Level.md (reported line 278)May include surrounding context.
md
- %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_) - %ASA-2-105527: (Primary|Secondary) Failure reading response to access token request

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Syslog Messages 101001 to 199027.md (reported line 740)May include surrounding context.
md
- %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_) - %ASA-2-105527: (Primary|Secondary) Failure reading response to access token request

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Syslog Messages 101001 to 199027.md (reported line 748)May include surrounding context.
md
- %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_) - %ASA-2-105527: (Primary|Secondary) Failure reading response to access token request

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Syslog Messages 101001 to 199027.md (reported line 756)May include surrounding context.
md
- %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_) - %ASA-2-105527: (Primary|Secondary) Failure reading response to access token request

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/Syslog Messages 101001 to 199027.md (reported line 772)May include surrounding context.
md
- %ASA-2-105525: (Primary|Secondary) Incomplete configuration to initiate access token change request - %ASA-2-105526: (Primary|Secondary) Unexpected status in response to access token request: _status_ (_status\_string_) - %ASA-2-105527: (Primary|Secondary) Failure reading response to access token request

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · references/Syslog Messages 101001 to 199027.md (reported line 167)May include surrounding context.
md
- no existing Active unit present - unable to send message to Active unit - no response to Hello message received from Active unit

Credential Access

High

Category: Privilege Escalation
Confidence: 71% confidence
Finding: The instruction to copy 'the configuration' and send it for troubleshooting is risky because ASA configurations can contain sensitive values, keys, topology, and authentication details. In an agent-assisted workflow, this can lead to overcollection and disclosure of secrets to external support channels or ticket systems.
Content: Scanner excerpt · references/Syslog Messages 101001 to 199027.md (reported line 750)May include surrounding context.
md
**Error Message** `%ASA-2-105527: (Primary|Secondary) Failure reading response to access token request` **Explanation** An internal error occurred while receiving a response to an Azure access token request. **Recommended Action** Copy the error message, the configuration, and any details about the events leading up to the error, and contact Cisco TAC.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 80% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · references/Syslog Messages 400000 to 450002.md (reported line 2042)May include surrounding context.
md
- _number0_ —The SLA operation number - _number1_ —The SLA operation event ID **Recommended Action** If this recurs, enter the show sla monitor configuration SLA\_operation\_id command and copy the output of the command. Copy the message as it appears on the console or in the system log. Then contact the Cisco TAC and provide the representative with the information that you have, along with information about the application that is configuring and polling the SLA probes. ### 422005

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · references/Syslog Messages 722001 to 776020.md (reported line 2695)May include surrounding context.
md
\- coredump, unidentified error encountered **Recommended Action** Make sure that the core dump feature is disabled in the configuration, and send the message to the Cisco TAC for further analysis. ### 741006

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · references/Syslog Messages 722001 to 776020.md (reported line 4135)May include surrounding context.
md
For ASA IKEv2, the initial contact (IC) processing is done based on peer IP/Port and ASA IP/Port pairs and the stale sessions get deleted based on these IP/Port pairs. This could be a problem with NAT as IP/Port of peer may change for connections and the stale sessions would not get cleaned up based on IP/Port pairs. As per the IKEv2 RFC , the Initial Contact processing will be switched to use Identity pairs so that the stale sessions can be identified based on peer and ASA identities and clear them. The identities can be IPs, hostnames, Certificate DNs, and so on. This syslog displays the exact reason for clearing the stale sessions. This syslog will be generated on ASA after clearing a stale session from a peer while negotiating a new IKEv2 session with the same peer. This syslog is applicable only for standalone and clustering site-to-site VPNs and not for RA. **Recommended Action** IKEv2 session Initial Contact processing is done to reset state between peers and clear the stale sessions. If sessions are getting cleared unexpectedly due to Initial Contact processing, ensure that all peers are configured with unique identities. ### 750015

Context Leakage

High

Category: Data Exfiltration
Confidence: 85% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Content: Scanner excerpt · references/Messages Listed by Severity Level.md (reported line 1727)May include surrounding context.
md
### 8300003 **Error Message** `%ASA-3-8300003: Failed to send session redistribution message to <variable 1>` **Explanation** There was an error sending a request to another cluster member. This could be due to an internal error or the cluster member the message was destined for is not available.

Context Leakage

High

Category: Data Exfiltration
Confidence: 85% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Content: Scanner excerpt · references/Syslog Messages 776201 to 8300006.md (reported line 894)May include surrounding context.
md
### 8300003 **Error Message** `%ASA-3-8300003: Failed to send session redistribution message to <variable 1>` **Explanation** There was an error sending a request to another cluster member. This could be due to an internal error or the cluster member the message was destined for is not available.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/About Cisco Secure Firewall ASA.md (reported line 122)May include surrounding context.
md
| _Device-ID_ | The device identifier string that was configured while enabling the logging device-id option through the user interface. If enabled, the device ID does not appear in EMBLEM-formatted syslog messages. | | ASA | The syslog message facility code for messages that are generated by the ASA. This value is always `ASA`. | | _Level_ | 0 through 7. The level reflects the severity of the condition described by the syslog message—the lower the number, the more severe the condition. | | _Message_number_ | A unique six-digit number that identifies the syslog message. | | _Message_text_ | A text string that describes the condition. This portion of the syslog message sometimes includes IP addresses, port numbers, or usernames. | All syslog messages that are generated by the device are documented in this guide.

Static analysis

No suspicious patterns detected.