EUVD-2026-81125
GHSA-3p99-hh66-cfh4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent access to EIGRP interface
-
DeliverySend high-rate crafted EIGRP updates
-
ExploitTrigger memory leak in update handler
-
ExecutionExhaust device memory
-
ImpactDevice reloads, denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Exploitation requires that EIGRP dynamic routing is configured and active on the Cisco Secure Firewall ASA or FTD device - this is not enabled in default configurations, so devices without EIGRP are not affected. The attacker must be unauthenticated but network-adjacent (AV:A): positioned within the EIGRP routing adjacency / same Layer-2 broadcast domain as an EIGRP-enabled interface to deliver update messages, which cannot be routed across the internet. Exploitation also requires sending crafted EIGRP updates at a high rate to accumulate the memory leak, so a single packet is insufficient - sustained traffic is needed before the device reloads. No user interaction or credentials are required once adjacency and EIGRP configuration conditions are met. |
| Impact | This is a genuine but bounded availability risk. The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H yields 7.4 (High) driven entirely by A:H - there is no confidentiality or integrity impact; the sole outcome is an unexpected device reload (DoS). The most important limiter is AV:A (Adjacent): the attacker must be on the same Layer-2/routing adjacency as an EIGRP-speaking interface, which strongly bounds who can reach the flaw versus a routable AV:N attack. A second, decisive limiter not captured in the base score is that EIGRP dynamic routing must be explicitly configured on the ASA/FTD - a non-default deployment condition. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC data provided. Net: for the subset of Cisco firewalls actually running EIGRP with an attacker-reachable adjacency, this is a real availability priority (crashes a security-critical inline device); for the majority not running EIGRP, real-world risk is minimal. No signals conflict, but the raw 7.4 overstates risk for typical default deployments because EIGRP is not enabled out of the box. |
| Exploit ScenarioDerived | An attacker positioned on a network segment or peering adjacency with an EIGRP-enabled ASA/FTD interface sends a sustained high rate of crafted EIGRP update messages. Improper resource management leaks memory on each malformed update until the device exhausts memory and reloads, dropping all traffic it inspects or routes. No public exploit code is identified at time of analysis, and no authentication is required, but the attacker must have adjacent-network EIGRP reachability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to reload the device by flooding crafted EIGRP update messages, triggering a memory leak that accumulates until the appliance restarts. The flaw is only reachable when EIGRP dynamic routing is configured and active on an interface - it is not present in default configurations - and the attacker must sit within the same Layer-2 broadcast domain/EIGRP adjacency, so the attack cannot be launched across the internet. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the independent assessment rates this a genuine but bounded availability risk (CVSS 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) because sustained, high-rate traffic is required rather than a single packet.
RemediationAI
Cisco has published a security advisory (cisco-sa-asaftd-eigrp-dos-GOhNejSj, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-eigrp-dos-GOhNejSj) covering this issue; upgrade ASA and FTD deployments to the fixed software releases listed there for your train - vendor-released patched versions are available per that advisory, and no patch status contradicting this was identified. If immediate upgrade is not possible, the most effective compensating control is to disable EIGRP on interfaces that do not require dynamic routing ('no router eigrp' / removing EIGRP from the interface), noting the trade-off that this removes dynamic route learning and requires static routes or an alternate routing protocol. Second, restrict EIGRP reachability so that only trusted routers can reach the firewall's EIGRP-speaking interface: apply infrastructure ACLs (iACLs) permitting IP protocol 88 only from authorized neighbor addresses, and enforce EIGRP authentication (MD5/SHA) so spoofed or rogue neighbors are rejected - the caveat being that authentication does not stop a compromised or authenticated neighbor from sending high-rate updates, and ACL errors can break legitimate adjacency formation. Because exploitation requires adjacency-level (AV:A) access, ensuring no untrusted hosts share a Layer-2 segment with the firewall's routing interfaces, and segmenting/limiting broadcast domains, materially reduces exposure. Finally, monitor device memory and unexpected reload events, and enable logging for EIGRP adjacency changes, to detect exploitation attempts while mitigation is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Enhanced Interior Gateway Routing Protocol (EIGRP) implementation in Cisco Secure Firewall ASA Software (9.19.x through current 9.24.x trains) and Cisco Secure Firewall Threat Defense (FTD) Software (7.3.x through 10.0.0 trains), as reflected in the CPE identifiers cpe:2.3:a:cisco:cisco_secure_firewall_adaptive_security_appliance_(asa)_software and cpe:2.3:a:cisco:cisco_secure_firewall_threat_defense_(ftd)_software. EIGRP is Cisco's advanced distance-vector routing protocol that runs directly over IP protocol number 88 and forms adjacencies with neighboring routers on the same broadcast domain via hello/update packets; because it operates at Layer 2 adjacency scope, the CVSS vector correctly uses AV:A rather than AV:N. The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime): the device mishandles resource management while processing incoming EIGRP update messages, so each crafted update leaves memory allocated that is never freed. The metric S:C (Scope Changed) is warranted because the resulting memory exhaustion and forced reload affects the entire firewall platform, not just the vulnerable EIGRP process - a DoS on the device impacts all traffic flows it is protecting.
Know when Cisco Secure Firewall Adaptive Security Appliance Asa Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EIGRP is a link-adjacent routing protocol so AV:A/PR:N/UI:N; routing-process crash reloading the whole appliance justifies S:C and A:H, with no C/I impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the EIGRP implementation in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is due to improper resource management when handling EIGRP update messages. An attacker could exploit this vulnerability by sending crafted EIGRP updates at a high rate to an affected device. A successful exploit could allow the attacker to trigger a memory leak that will eventually cause the affected device to reload unexpectedly.
Executive ViewAI
Cisco Secure Firewall ASA and FTD appliances running EIGRP dynamic routing can be forced into an unplanned reload by a network-adjacent, unauthenticated attacker, creating a denial-of-service condition against perimeter security enforcement. Exposure is bounded to organizations that have EIGRP enabled on an interface facing a shared Layer-2 segment, and no vendor patch or public exploit code has been identified at time of analysis, so leadership should treat this as a manageable but real availability risk to network segmentation and remote-access continuity rather than an imminent internet-facing threat.
No vendor-released patch identified at time of analysis. Interim mitigations: disable EIGRP on any interface not strictly required; where EIGRP must remain, enable EIGRP authentication (MD5 or SHA-256 key chains) and restrict peering to explicitly configured neighbor addresses; apply Layer-2 controls on adjacent switches including storm control, port security, DHCP snooping, dynamic ARP inspection, and 802.1X to prevent unauthorized hosts from joining the broadcast domain; segment EIGRP-enabled interfaces away from untrusted or shared L2 segments; ensure active/standby failover is correctly configured and tested so a single appliance reload does not cause an outage; and monitor device memory utilization, EIGRP adjacency logs, and unexpected reload events as detection signals.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Exploit-DB