EUVD-2026-81112
GHSA-rf4g-28mq-c9qr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing ASA/FTD DTLS endpoint
-
DeliverySend crafted stream of DTLS messages
-
ExploitTrigger improper resource management (CWE-772)
-
ExecutionDevice exhausts resources and reloads
-
ImpactDenial of service on protected network
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup on lifecycle end
|
| Exploitation Conditions | Requires network reachability to the DTLS message-handling service on Cisco Secure Firewall 3100 Series or 4200 Series devices running affected ASA (9.22.x-9.24.1) or FTD (7.6.x-10.0.0) software - in practice this means the DTLS listener used by remote-access VPN (Secure Client/AnyConnect DTLS) must be enabled and reachable by the attacker. No authentication, no privileges, and no user interaction are needed (PR:N/UI:N). Exploitation is LIMITED to the named 3100/4200 hardware platforms; other ASA/FTD models are not listed as affected, and impact is confined to availability (device reload) with no data exposure. |
| Impact | This is a genuine, defensible high-severity issue rather than an inflated CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H (8.6) is internally consistent: an unauthenticated, network-based, low-complexity attack with no user interaction, scope change (the crashed data plane affects transiting/protected traffic), and pure availability impact (device reload). The A:H-only shape matches the description precisely - this is a reliability/DoS flaw (CWE-772, missing release of resource), not code execution, so C:N/I:N is correct and there is no data-compromise angle. Mitigating the urgency: no CISA KEV listing, no public POC identified, and no EPSS score is provided, so there is no evidence of active or imminent exploitation. The main risk driver is exposure - a DTLS-processing surface (typically AnyConnect/Secure Client remote-access VPN) is often internet-facing, and any host able to reach the DTLS listener can crash the firewall repeatedly with no credentials. Bottom line: not a confidentiality/integrity emergency, but a legitimate availability priority for internet-exposed 3100/4200-series firewalls because it is unauthenticated, low-complexity, and network-reachable. No signals conflict; the CVSS vector aligns with the description. |
| Exploit ScenarioDerived | An attacker who can reach the DTLS service (e.g., the remote-access VPN endpoint) on an internet-facing Cisco Secure Firewall 3100/4200 sends a crafted stream of DTLS traffic. Improper resource management during DTLS message processing exhausts or corrupts device state, forcing the appliance to reload and dropping all traffic through it. No authentication or user interaction is required; no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software on 3100 Series and 4200 Series appliances, where a crafted stream of DTLS traffic causes improper resource management and forces the device to reload. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), reflecting that no credentials or user interaction are required and that the impact is purely availability, though the scope change acknowledges the disruption extends beyond the vulnerable component itself. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, so exploitation requires either opportunistic scanning of exposed DTLS listeners or targeted traffic against internet-facing firewalls.
RemediationAI
No fixed software release is enumerated in the available data; the vendor advisory cisco-sa-asaftd-dtls-dos-Kp57HkyO (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-dtls-dos-Kp57HkyO) should be consulted for the exact patched ASA and FTD builds for each affected train, so upgrade to the version Cisco designates there rather than assuming any specific release. Until an upgrade can be scheduled, the most effective compensating control is to disable DTLS for remote-access VPN on affected 3100 and 4200 Series appliances and force clients to use TLS-based (TCP) sessions, which removes the vulnerable message-handling path entirely; the trade-off is higher latency and potentially lower throughput for latency-sensitive traffic such as voice and video over the VPN. Where DTLS must remain enabled, restrict reachability to the DTLS listener with an access control list or interface-based filtering so only trusted client source ranges and geographies can send UDP traffic to the DTLS port, accepting that this complicates roaming and mobile client support. Monitor for repeated DTLS session churn, resource exhaustion alarms, or unexpected reloads as an early indicator, and treat any internet-facing DTLS listener on these platforms as a priority for mitigation given the unauthenticated, network-reachable attack path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-772 (Missing Release of Resource after Effective Lifetime), i.e. a resource leak in the Datagram TLS message-handling path. DTLS is the UDP-based variant of TLS used by Cisco's remote-access VPN clients (Secure Client / AnyConnect) to establish low-latency tunnels, and the firewall maintains per-connection state, buffers, and cryptographic contexts for each DTLS session. When certain DTLS messages are processed, resources allocated for that handling are not released back to the pool, so a sustained or crafted stream of DTLS traffic progressively exhausts those resources until the data plane or control process can no longer operate and the device reloads. CPE data confirms the affected product families are cisco:cisco_secure_firewall_adaptive_security_appliance_(asa)_software and cisco:cisco_secure_firewall_threat_defense_(ftd)_software, but exposure is gated by hardware: only Cisco Secure Firewall 3100 Series and 4200 Series platforms are covered, meaning the DTLS listener used for remote-access VPN must be enabled and reachable. The CVSS scope change (S:C) is consistent with a component-level leak cascading into a full-device reload rather than a contained process crash.
Know when Cisco Secure Firewall Adaptive Security Appliance Asa Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Unauthenticated network-reachable DTLS crash with no interaction (AV:N/AC:L/PR:N/UI:N); crashed firewall disrupts transiting/protected traffic (S:C); pure availability impact (A:H, C:N/I:N).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in Datagram TLS (DTLS) message handling of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Cisco Secure Firewall 3100 Series and 4200 Series devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper resource management when processing certain DTLS messages. An attacker could exploit this vulnerability by sending a crafted stream of DTLS traffic to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Executive ViewAI
Cisco Secure Firewall ASA and FTD running on 3100 Series and 4200 Series appliances can be forced into a full reload by unauthenticated DTLS traffic sent from any internet-connected host, with no credentials or user interaction required. Because these platforms sit at the network perimeter, a single successful trigger can take a critical enforcement and remote-access control offline, disrupting VPN connectivity and inspection for everything behind it until the device recovers. The flaw carries no confidentiality or integrity impact, so leadership should frame this as a network availability and business-continuity risk rather than a data-exposure event.
No vendor-released patch identified at time of analysis. Interim mitigations: disable DTLS on internet-facing interfaces and force TLS-only for AnyConnect; block or rate-limit inbound UDP 443 destined for 3100 and 4200 Series appliances at the upstream edge; restrict DTLS sources to known client ranges; enable reload and crash alerting; maintain validated HA failover, backups, and out-of-band management; pursue an interim build via Cisco TAC.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Exploit-DB