EUVD-2026-81125
GHSA-3p99-hh66-cfh4
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EIGRP is a link-adjacent routing protocol so AV:A/PR:N/UI:N; routing-process crash reloading the whole appliance justifies S:C and A:H, with no C/I impact.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the EIGRP implementation in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is due to improper resource management when handling EIGRP update messages. An attacker could exploit this vulnerability by sending crafted EIGRP updates at a high rate to an affected device. A successful exploit could allow the attacker to trigger a memory leak that will eventually cause the affected device to reload unexpectedly.
AnalysisAI
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to reload the device by flooding crafted EIGRP update messages, triggering a memory leak that accumulates until the appliance restarts. The flaw is only reachable when EIGRP dynamic routing is configured and active on an interface - it is not present in default configurations - and the attacker must sit within the same Layer-2 broadcast domain/EIGRP adjacency, so the attack cannot be launched across the internet. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that EIGRP dynamic routing is configured and active on the Cisco Secure Firewall ASA or FTD device - this is not enabled in default configurations, so devices without EIGRP are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Cisco has published a security advisory (cisco-sa-asaftd-eigrp-dos-GOhNejSj, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-eigrp-dos-GOhNejSj) covering this issue; upgrade ASA and FTD deployments to the fixed software releases listed there for your train - vendor-released patched versions are available per that advisory, and no patch status contradicting this was identified. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cisco Secure Firewall ASA and FTD deployments and identify which interfaces have EIGRP enabled and active, then confirm whether any of those interfaces face untrusted, partner, or shared Layer-2 segments; where EIGRP is not operationally required, disable it immediately and monitor device memory and syslog for unexpected EIGRP neighbor churn or reload events. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Access-control bypass in Cisco Secure Firewall ASA and Threat Defense (FTD) software allows an unauthenticated, remote a
Same weakness CWE-401 – Memory Leak
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today