I can no longer trust Cisco to make any effort to patch their products for security vulnerabilities.CSCvp80474 has already been patched on the older ASA model that we we're prepared to buy until Cisco sold us on these new "Firepower" devices. I currently have 3 open tickets one about not being able to apply a CA signed security certificate to the web interface, another NAT rule corruption issue (which was partially solved by downgrading to 6.4, and now one with an OpenSSL vulnerability that allows decrypting the SSL VPN traffic. The solution given from Cisco TAC about all of these issues is they are fixed or expected to be fixed in version 6.7 and when I ask when 6.7 will be released I only get "Unfortunately we do not have any ETA for 6.7 as of now". Being that I have no control over the virtual ASA appliance I can't disable the vulnerable cipher suites. We are just ignored and nobody at Cisco seems to care!
Given that Cisco also seems to have a bad habit of hard coding credentials (https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-auth-bypass from 6 days ago) I can't imagine what hidden vulnerabilities exist in this product.
