EUVD-2026-81150
GHSA-xxfc-5fpg-3fhq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Unauthenticated remote crafted SSL packet (AV:N/AC:L/PR:N/UI:N); flaw in inspection engine disrupts forwarded traffic (S:C); only transient engine restart, so A:L and C:N/I:N.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 2 Detection Engine to restart.
This vulnerability is due to incomplete validation of the SSL certificate. An attacker could exploit this vulnerability by sending a crafted SSL connection setup request to be parsed by Snort 2. A successful exploit could allow the attacker to cause the Snort 2 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.
AnalysisAI
Denial of service in Cisco Secure Firewall Threat Defense (FTD) can be triggered remotely without authentication when the legacy Snort 2 Detection Engine parses a crafted SSL/TLS certificate during connection setup, causing the engine to restart unexpectedly. The flaw affects FTD releases running Snort 2 and processing SSL policy inspection; the provided assessment rates it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), so impact is limited to a transient availability loss rather than code execution or data compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The affected device must be a Cisco Secure Firewall Threat Defense (FTD) instance running the legacy Snort 2 Detection Engine (not Snort 3) and processing SSL/TLS traffic such that certificate parsing occurs - i.e., handling SSL connection setup / SSL policy inspection. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L, base 5.8) describes a network-reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact and only LOW availability impact - a transient DoS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Cisco has published a security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort2-ssldos-Mw7WYX9c and the input does not provide a specific fixed FTD version; patch status is therefore 'Patch available per vendor advisory' and administrators should consult that advisory for the exact fixed releases and upgrade instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Unauthenticated adjacent attackers who can reach the sftunnel inter-device management channel can impersonate the peer d
Same weakness CWE-805 – Buffer Access with Incorrect Length Value
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today