EUVD-2026-81143
GHSA-qxw6-2w65-g7rg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain control of queried DNS server or MITM position
-
DeliveryWait for device-initiated TCP DNS query
-
ExploitReturn crafted malformed DNS reply
-
ExecutionTrigger buffer-size logic error (CWE-195) in TCP DNS response handler
-
PersistHandler restarts and device reloads
-
ImpactDenial of service across protected segments
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Signed/unsigned conversion safety
|
| Exploitation Conditions | Exploitation requires that the ASA/FTD device performs DNS resolution and that the attacker can respond to the DNS queries the device sends - either by controlling the DNS server the device queries or by holding a machine-in-the-middle position on the device's DNS path (explicitly stated in the Cisco note). The device must use DNS over TCP for the vulnerable response handler to be reached. No authentication (PR:N) and no user interaction (UI:N) are needed, but the DNS-response-control requirement plus the specificity of the crafted malformed reply raise attack complexity (AC:H). Impact is limited to availability - a device reload/DoS - with no data exposure or modification. All listed ASA (9.16.x-9.24.x) and FTD (7.0.x-10.0.0, 7.7.x) versions are affected. |
| Impact | This is a denial-of-service-only flaw: the CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H, 6.8 Medium) shows no confidentiality or integrity impact - only availability (A:H, full device reload). Although PR:N marks it unauthenticated, AC:H correctly captures the real limiter: per Cisco's note, the attacker must be able to answer DNS queries the device itself originates, meaning they must either operate the queried DNS server or hold a man-in-the-middle position on the device's DNS path. That is a meaningful precondition that keeps this from being a spray-and-pray internet-wide DoS. S:C reflects that a crashing/reloading firewall takes down traffic for all protected segments, not just the vulnerable process. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization at time of analysis. Net: a real but moderate-priority patch item for Cisco firewall operators - availability-critical for edge devices, but gated by the DNS-response-control requirement and with no exploitation signal. No data conflicts noted; the vector and description are consistent. |
| Exploit ScenarioDerived | An attacker who controls a DNS server the firewall queries - or who can machine-in-the-middle the device's DNS traffic - waits for the ASA/FTD to send a DNS query over TCP, then returns a crafted DNS reply that triggers the buffer-size tracking logic error in the TCP DNS response handler. The response handler restarts unexpectedly and the device reloads, dropping all traffic it protects. No authentication or user interaction is required, but the attacker must be positioned to answer the device's DNS queries; no public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be triggered by a crafted DNS reply, causing the device to reload and resulting in a denial-of-service condition. The attacker must be able to respond to DNS queries originating from the device-either by controlling the DNS service or via a machine-in-the-middle position-and the device must use DNS over TCP. No public exploit code has been identified at the time of analysis, and the CVSS score is 6.8 (Medium) with only availability impact.
RemediationAI
Patch status is not confirmed from the provided data; consult the Cisco advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tcpdns-dos-p6dUnjr5 for patched software versions. As a workaround, disable DNS over TCP on the affected device if it is not operationally required-note that this may impact DNS resolution for large responses or zone transfers. Additionally, ensure DNS queries are sent only to trusted, controlled DNS servers and protect the DNS path with DNSSEC or IPsec to prevent machine-in-the-middle attacks. Restrict management access to the device to reduce the attack surface. These mitigations have trade-offs: disabling DNS over TCP may break certain applications, and network segmentation adds complexity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the DNS over TCP implementation of Cisco Secure Firewall ASA and FTD software. DNS over TCP is used for larger DNS responses and zone transfers. The flaw is a logic error when parsing a DNS query and tracking the size of incoming buffers, classified as CWE-195 (Signed to Unsigned Conversion Error), which can lead to incorrect buffer size calculations and cause the TCP DNS response handler to restart unexpectedly, reloading the device. The affected products are Cisco Secure Firewall ASA Software (CPE: cpe:2.3:a:cisco:cisco_secure_firewall_adaptive_security_appliance_(asa)_software) and Cisco Secure Firewall FTD Software (CPE: cpe:2.3:a:cisco:cisco_secure_firewall_threat_defense_(ftd)_software). All versions listed in the EUVD affected list (ASA 9.16.x through 9.24.x, FTD 7.0.x through 10.0.0 and 7.7.x) are vulnerable. The attack requires the device to perform DNS resolution and use TCP for DNS queries, and the attacker must be able to respond to those queries, either by controlling the DNS server or through a MITM position. The crafted reply triggers the logic error, leading to a denial-of-service condition via device reload.
Know when Cisco Secure Firewall Adaptive Security Appliance Asa Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Unauthenticated remote (PR:N) but AC:H because the attacker must control DNS responses or MITM the device; DoS-only reload gives A:H with C:N/I:N, and a firewall reload affects other systems (S:C).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the TCP DNS response handler to unexpectedly restart, causing the device to reload.
This vulnerability is due to a logic error when parsing a DNS query and tracking the size of the incoming buffers. An attacker could exploit this vulnerability by formatting a crafted reply to a DNS query sent from the targeted device. A successful exploit could allow the attacker to cause the device to reload, causing a denial of service (DoS) condition. Note: The attacker must be able to respond to DNS queries from the device, either by controlling the DNS service or through a machine-in-the-middle attack.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Exploit-DB