As Cisco uses bash (and web interfaces if you haven't disable it) is it susceptible to the shell shock vulnerability?
Cisco will need to confirm if they are vulnerable. I expect they are not since the lack of cgi scripting exposed through the web instance for CSM/ASDM. In the meantime you can mitigate a lot of risk by restricting http/https enable to specific hosts in your network.
Yes, It's possible that they are vulnerable. Although they are not sure yet. Cisco believes, that devices are only vurnerable, once you're authenticated. Therefore you can only exploit the bug when you'd have admin privilege anyway.
Check the following link for more information and status updates: http://tools.cisco.com/security/center/mcontent/CiscoSecurityAdvisory/cisco-sa-20140926-bash