EUVD-2026-81128
GHSA-fcpc-64j2-96jc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Unauthenticated remote SYN flood (AV:N/AC:L/PR:N/UI:N) causing device-local CPU exhaustion DoS (A:H only); I score S:U as impact is on the vulnerable device itself, unlike the vendor's S:C.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device, resulting in a denial of service (DoS) condition.
This vulnerability is due to improper rate limiting for syslog message 419002. An attacker could exploit this vulnerability by sending a flood of TCP synchronization (SYN) packets to an affected device. A successful exploit could allow the attacker to cause high CPU utilization, resulting in performance degradation.
AnalysisAI
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU utilization, degrading or interrupting traffic handling in an availability-only denial of service. The defect is in the rate-limiting path for syslog message 419002, which is generated at high volume during SYN floods and is not throttled correctly, so the logging/rate-limiting process keeps consuming CPU instead of shedding the excess events. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to a TCP-listening interface of an affected Cisco Secure Firewall ASA or FTD device - the attacker sends a flood of TCP SYN packets, no authentication (PR:N) or user interaction (UI:N) needed, against default configurations where syslog message 419002 rate-limiting is in effect. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability-only issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so the authoritative fix mapping must be taken from Cisco's advisory, cisco-sa-asa-ftd-logging-dos-ZXXNesfN (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-logging-dos-ZXXNesfN), which publishes the per-train fixed releases for ASA 9.16.x/9.18.x/9.19.x/9.20.x/9.22.x/9.23.x and FTD 7.0.x-7.7.x; upgrade to the listed fixed build for your train. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Cisco Secure Firewall ASA in the 9.16.x-9.23.x ranges and FTD in the 7.0.x-7.7.x ranges, confirm which are internet- or partner-facing, and flag them as exposure points; at the same time open a case with Cisco TAC to obtain the current workaround guidance and confirm which syslog-419002 logging/rate-limiting tuning options are supported on our running releases. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Access-control bypass in Cisco Secure Firewall ASA and Threat Defense (FTD) software allows an unauthenticated, remote a
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today