Secure Firewall Threat Defense
CVE-2026-20006
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the TLS cryptography functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to unexpectedly restart, resulting in a denial of service (DoS) condition.
This vulnerability is due to improper implementation of the TLS protocol. An attacker could exploit this vulnerability by sending a crafted TLS packet to an affected system. A successful exploit could allow the attacker to cause a device that is running Cisco Secure FTD Software to drop network traffic, resulting in a DoS condition. Note: TLS 1.3 is not affected by this vulnerability.
AnalysisAI
Cisco Secure Firewall Threat Defense (FTD) Software is vulnerable to denial of service through improper TLS protocol implementation in the Snort 3 Detection Engine, allowing unauthenticated remote attackers to trigger unexpected restarts by sending crafted TLS packets. Successful exploitation causes the affected device to drop network traffic, creating a DoS condition affecting TLS versions prior to 1.3. No patch is currently available.
Technical ContextAI
exists in the TLS cryptography component. in the TLS cryptography functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to unexpectedly restart, resulting in a denial of service (DoS) condition.
This vulnerability is due to improper implementation of the TLS protocol. An attacker could exploit this vulnerability by sending a crafted TLS packet to an affected system. A successful exploit could allow the
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Denial of service via crafted HTTP requests to the Remote Access SSL VPN service affects Cisco Secure Firewall ASA and F
Cisco Snort 3 Detection Engine can be remotely restarted by an unauthenticated attacker through crafted HTTP packets exp
Unauthenticated remote attackers can crash the Snort 3 Detection Engine by sending crafted HTTP packets with malformed M
Denial of service in Cisco Snort 3's VBA decompression feature allows unauthenticated remote attackers to crash the dete
Improper error checking in Cisco Snort 3's VBA decompression feature allows unauthenticated remote attackers to trigger
Improper range checking in Cisco Snort 3's VBA decompression feature allows unauthenticated remote attackers to trigger
Denial of service in Cisco Secure Firewall Threat Defense via crafted SSL packets allows unauthenticated remote attacker
Snort 3 Detection Engine in multiple Cisco products can be remotely restarted by unauthenticated attackers through craft
Snort 3 detection engine contains a vulnerability that allows attackers to cause a DoS condition when the Snort 3 Detect
Snort 3 Detection Engine contains a vulnerability that allows attackers to cause a denial of service (DoS) condition whe
Snort rule bypass in Cisco Secure Firewall Threat Defense allows unauthenticated remote attackers to evade deep packet i
Same weakness CWE-388 – 7PK - Errors
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today