EUVD-2026-81123
GHSA-6f7g-r5ww-w353
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach TLS 1.3 listening socket
-
DeliverySend crafted TLS 1.3 packet
-
ExploitTrigger improper buffer management (double free)
-
ExecutionCrash LINA process
-
ImpactDevice reloads, denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Double free prevention
|
| Exploitation Conditions | Exploitation requires that the FTD device expose a TLS 1.3-enabled listening socket reachable by the attacker; per the advisory, TLS 1.3 connections cover both data traffic and user-management traffic, so any TLS 1.3-terminating service on the box is a candidate target. No authentication is needed - the crash can occur before or after connection authentication - and no user interaction or special privileges are required. The practical limiting factor is network reachability to a TLS 1.3 listener and the device actually negotiating TLS 1.3; impact is limited to availability (device reload/DoS) with no data disclosure or modification. |
| Impact | This is a genuine, well-scoped denial-of-service issue that warrants prioritized patching on internet-facing or otherwise reachable Cisco FTD appliances. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, 8.6) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, and pure availability impact - the reload happens 'before or after authentication,' confirming PR:N is honest rather than optimistic. Scope change (S:C) is defensible because a crash of the LINA data-plane process forces a full device reload, taking down more than the vulnerable TLS component. No EPSS score, no CISA KEV listing, and no public POC were provided, so this is 'no public exploit identified at time of analysis' - not active exploitation. The signals are non-conflicting: high CVSS is driven entirely by A:H plus scope, not by a fabricated confidentiality/integrity impact, so this is a real availability priority rather than an inflated score. The main caveat is that CWE-415 (Double Free) is asserted while the narrative text says 'improper buffer management,' a minor taxonomy tension worth noting but not affecting the risk picture. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach a TLS 1.3-enabled listening socket on an FTD device (e.g., a management interface, remote-access VPN, or any TLS 1.3 data-traffic listener) sends a single crafted TLS 1.3 packet. Improper buffer management during the connection crashes the LINA process, forcing the device to reload and dropping all traffic through it. No public exploit code has been identified, and repeated packets could sustain an outage of the firewall. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled reload and denying service to everything the appliance protects. The flaw is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) and triggers during or after the TLS 1.3 handshake, so any TLS 1.3-enabled listening socket reachable by an attacker is a candidate target - including both data-traffic and user-management listeners. Cisco has published an advisory for this issue; no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but the low complexity and network reachability required make it a realistic DoS vector against internet-exposed appliances.
RemediationAI
Apply the fixed Cisco FTD release for your train as documented in the Cisco security advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-tls1.3-dos-dLxwFWgF); the supplied data does not enumerate exact fixed version numbers, so confirm the target release against that advisory rather than assuming a specific build. If immediate upgrade is not possible, reduce the attack surface by disabling TLS 1.3 where it is not required - configure the affected listener to negotiate TLS 1.2 only - accepting the trade-off of weaker cipher and key-exchange options for the duration of the exposure. For management listeners (FDM/ASDM access on the Management or Data interfaces), restrict reachability to trusted administrative networks via interface ACLs or platform control-plane ACLs; note that control-plane protections will not cover data-plane TLS listeners such as those used by SSL/TLS inspection or remote-access VPN termination, so those should be fronted by an upstream device that can filter malicious TLS 1.3 handshakes. Because the crash can occur before authentication, authentication-based controls and account lockout policies provide no protection; only network-path restriction and patching do. Monitor syslog and SNMP for unexpected LINA restarts or device reloads as an indicator that the flaw is being probed, and stage upgrades during maintenance windows since a reload of an FTD appliance disrupts all protected traffic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Cisco FTD's TLS 1.3 protocol handling, classified as CWE-415 (double free) and described by the vendor as improper buffer management during a TLS 1.3 connection. TLS 1.3 differs substantially from prior versions - a simplified handshake, encrypted handshake records after ServerHello, and key scheduling through HKDF - which means malformed or unexpected record structures must be handled by stateful parsers on the LINA (Linux Application) data-plane engine. A parsing or buffer-lifetime error in that path lets a single crafted TLS 1.3 packet free the same buffer twice or otherwise corrupt memory, aborting the LINA process; because LINA is central to packet processing on the appliance, its crash escalates to a full device reload. The scope-change metric (S:C) reflects that taking down a firewall affects the integrity/confidentiality context of every system behind it, even though the CVE itself causes only availability loss. The CPE cpe:2.3:a:cisco:cisco_secure_firewall_threat_defense_(ftd)_software:*:*:*:*:*:*:*:* is version-wildcarded, and EUVD's version list spans the 7.0.0 through 7.7.x release trains, indicating a long-lived defect in the TLS 1.3 stack rather than a single-branch regression.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Unauthenticated network-reachable crafted packet (AV:N/AC:L/PR:N/UI:N), LINA crash reloads the whole device (S:C, A:H), with no confidentiality or integrity impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is due to improper buffer management during the TLS 1.3 connection. An attacker could exploit this vulnerability by sending a crafted TLS 1.3 packet to an affected system through a TLS 1.3-enabled listening socket. A successful exploit could allow the attacker to cause the LINA process to crash, which would cause the device to reload. The reload can happen before or after authentication of the connection.Note: TLS 1.3 connections include both data traffic and user-management traffic.
Executive ViewAI
Cisco Secure Firewall Threat Defense (FTD) appliances are affected by a high-severity, unauthenticated denial-of-service vulnerability that can cause an unscheduled reload, disrupting all network traffic and security enforcement the device provides. No vendor-released patch identified at time of analysis, and the flaw is exploitable via crafted TLS 1.3 packets, so any internet-facing or internal FTD with TLS 1.3 enabled poses a significant risk to organizational network availability. Leadership should treat this as a priority operational risk, as repeated crashes could lead to extended outages of critical perimeter defenses.
Disable TLS 1.3 on affected FTD listeners if operationally feasible; restrict network access to management and data interfaces to trusted sources using ACLs; monitor for unexpected reloads and TLS 1.3 handshake anomalies; apply any vendor-provided workarounds as they become available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Exploit-DB