EUVD-2026-81112
GHSA-rf4g-28mq-c9qr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Unauthenticated network-reachable DTLS crash with no interaction (AV:N/AC:L/PR:N/UI:N); crashed firewall disrupts transiting/protected traffic (S:C); pure availability impact (A:H, C:N/I:N).
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in Datagram TLS (DTLS) message handling of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Cisco Secure Firewall 3100 Series and 4200 Series devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper resource management when processing certain DTLS messages. An attacker could exploit this vulnerability by sending a crafted stream of DTLS traffic to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
AnalysisAI
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software on 3100 Series and 4200 Series appliances, where a crafted stream of DTLS traffic causes improper resource management and forces the device to reload. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), reflecting that no credentials or user interaction are required and that the impact is purely availability, though the scope change acknowledges the disruption extends beyond the vulnerable component itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to the DTLS message-handling service on Cisco Secure Firewall 3100 Series or 4200 Series devices running affected ASA (9.22.x-9.24.1) or FTD (7.6.x-10.0.0) software - in practice this means the DTLS listener used by remote-access VPN (Secure Client/AnyConnect DTLS) must be enabled and reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, defensible high-severity issue rather than an inflated CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No fixed software release is enumerated in the available data; the vendor advisory cisco-sa-asaftd-dtls-dos-Kp57HkyO (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-dtls-dos-Kp57HkyO) should be consulted for the exact patched ASA and FTD builds for each affected train, so upgrade to the version Cisco designates there rather than assuming any specific release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Cisco ASA and Cisco Secure Firewall Threat Defense appliance on 3100 Series and 4200 Series hardware, confirm which are internet-facing, and identify any that terminate DTLS (UDP 443) - then apply interim mitigations immediately: disable DTLS on all outside-facing interfaces and force AnyConnect clients to TLS-only where remote-access VPN permits it, block or rate-limit inbound UDP 443 at the upstream edge or perimeter provider for appliances that cannot disable DTLS, and enable syslog and SNMP alerting on unexpected reload events so an attack attempt is visible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Access-control bypass in Cisco Secure Firewall ASA and Threat Defense (FTD) software allows an unauthenticated, remote a
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today