EUVD-2026-81128
GHSA-fcpc-64j2-96jc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing ASA/FTD interface
-
DeliverySend high-rate TCP SYN flood
-
ExploitTrigger unthrottled syslog 419002 generation
-
ExecutionExhaust device CPU
-
ImpactDenial of service / traffic degradation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to a TCP-listening interface of an affected Cisco Secure Firewall ASA or FTD device - the attacker sends a flood of TCP SYN packets, no authentication (PR:N) or user interaction (UI:N) needed, against default configurations where syslog message 419002 rate-limiting is in effect. The realistic limiter is not configuration but volume/positioning: the attacker must sustain sufficient SYN packet rate to the device, and impact is confined to CPU-driven performance degradation/DoS with recovery once the flood ceases - no persistence, code execution, or data access. Devices behind upstream SYN-flood protection or with restricted exposed interfaces face reduced practical risk. |
| Impact | This is a genuine but bounded availability-only issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, 8.6) confirms an unauthenticated, network-reachable, low-complexity attack with no confidentiality or integrity impact - pure DoS via CPU exhaustion. CWE-835 (loop with unreachable/uncontrolled exit) aligns with the described improper rate limiting of syslog message 419002, where a SYN flood forces disproportionate CPU work generating/handling log messages. No EPSS score, no CISA KEV listing, and no public PoC were provided, so exploitation status is 'no public exploit identified at time of analysis' - the 8.6 is severity, not observed activity. The main signal supporting real-world concern is that the target is an internet-facing firewall (SYN floods hit the outside interface trivially) and no authentication is needed; the main mitigant is that impact is limited to performance degradation/DoS with full recovery once traffic stops, and no code execution or data exposure is possible. Note the S:C (scope change) is defensible because a firewall's degradation affects the protected network behind it, but a stricter reading (device-local resource exhaustion) would score S:U (~7.5); this is the only metric worth verifying against the vendor advisory. |
| Exploit ScenarioDerived | An unauthenticated remote attacker directs a sustained flood of TCP SYN packets at an internet-facing ASA or FTD interface. Each connection attempt triggers syslog message 419002, but the flawed rate-limiting logic fails to throttle this generation, driving CPU to saturation and degrading or halting traffic processing. No PoC is publicly available at time of analysis; the technique (SYN flooding) requires only commodity tooling and no credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU utilization, degrading or interrupting traffic handling in an availability-only denial of service. The defect is in the rate-limiting path for syslog message 419002, which is generated at high volume during SYN floods and is not throttled correctly, so the logging/rate-limiting process keeps consuming CPU instead of shedding the excess events. The issue is remotely reachable and unauthenticated (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and covers a wide installed base of ASA 9.16.x-9.23.x and FTD 7.0.x-7.7.x releases; Cisco rates it 8.6 (scope-changed) whereas our independent assessment rates it 7.5 because impact remains confined to the affected device (S:U) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
No vendor-released patch version is identified in the available data, so the authoritative fix mapping must be taken from Cisco's advisory, cisco-sa-asa-ftd-logging-dos-ZXXNesfN (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-logging-dos-ZXXNesfN), which publishes the per-train fixed releases for ASA 9.16.x/9.18.x/9.19.x/9.20.x/9.22.x/9.23.x and FTD 7.0.x-7.7.x; upgrade to the listed fixed build for your train. Until that upgrade is applied, the most effective compensating control is to stop the SYN flood from reaching the appliance at all: enforce upstream SYN-flood protection or scrubbing (carrier/ISP-level or a dedicated DDoS mitigation tier), since the issue is reachability plus packet rate rather than a malformed packet - the trade-off is dependency on an external control you may not own and potential latency for legitimate traffic. Second, tighten exposure of the firewall's TCP-listening interfaces with control-plane ACLs or interface-level ACLs so only known management and transit peers can initiate connections, accepting that this requires accurate address inventories and can break legitimate remote-access or VPN ingress if over-restricted. Third, enable SYN-flood defenses on the platform itself - Cisco ASA TCP Intercept/SYN-cookie style protection or FTD's equivalent flood protection - which absorbs SYN volume but consumes memory and CPU and can add connection setup latency. Fourth, if message 419002 logging is not required for compliance or monitoring, reduce or suppress that specific syslog stream (lower log level or remove the logging destination for that event class); this directly removes the trigger path but sacrifices visibility into connection-teardown/denial events, which may be exactly the telemetry needed during an attack. Finally, monitor firewall CPU and syslog 419002 emission rates as a detection signal, and note that any device sitting behind upstream SYN scrubbing or without broadly reachable TCP interfaces has reduced practical exposure while a fix is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Secure Firewall ASA and FTD are network security platforms that perform stateful inspection and generate high-volume syslog telemetry; syslog message 419002 is emitted in bursts when TCP session setup fails (the SYN-flood condition described in the advisory). The affected component is the system rate-limiting process that is supposed to throttle such message floods before they reach the logging pipeline. CWE-835 (Loop with Unreachable Exit Condition) is the assigned root-cause class, indicating that the throttling/handling logic can enter a loop from which it does not exit cleanly, so instead of coalescing or dropping excess 419002 events the process continues to execute and saturates CPU. Because the trigger is a raw TCP SYN flood sent to any TCP-listening interface - not an authenticated API call or a crafted protocol payload - no credentials (PR:N) and no user interaction (UI:N) are required; attack complexity is low and the attack vector is network. The CPE data confirms both product lines are in scope (cisco:cisco_secure_firewall_adaptive_security_appliance_(asa)_software and cisco:cisco_secure_firewall_threat_defense_(ftd)_software, wildcarded across all versions). Note the deliberate scoring divergence: Cisco's vector uses S:C (8.6) while our assessment uses S:U (7.5), reflecting that the effect does not propagate beyond the device itself - the flood degrades the firewall, not downstream systems directly - and is transient, recovering once the packet rate drops. The practical precondition is volume and positioning rather than configuration: the attacker must sustain enough SYN traffic to the exposed interface, so devices shielded by upstream SYN-flood mitigation or with tightly restricted externally reachable interfaces carry materially lower practical risk.
Know when Cisco Secure Firewall Adaptive Security Appliance Asa Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Unauthenticated remote SYN flood (AV:N/AC:L/PR:N/UI:N) causing device-local CPU exhaustion DoS (A:H only); I score S:U as impact is on the vulnerable device itself, unlike the vendor's S:C.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device, resulting in a denial of service (DoS) condition.
This vulnerability is due to improper rate limiting for syslog message 419002. An attacker could exploit this vulnerability by sending a flood of TCP synchronization (SYN) packets to an affected device. A successful exploit could allow the attacker to cause high CPU utilization, resulting in performance degradation.
Executive ViewAI
Cisco Secure Firewall ASA (9.16.x-9.23.x) and FTD (7.0.x-7.7.x) appliances - the perimeter enforcement points protecting most of our external-facing services - can be pushed into sustained high CPU by unauthenticated TCP SYN floods, degrading or interrupting the traffic they pass. Because the affected platforms are broadly deployed across our network edge and no fix is yet available, any internet-facing or partner-reachable firewall is a candidate target for a low-skill, availability-focused attack, while data confidentiality and integrity remain unaffected. Leadership should care because a successful event translates into dropped connections and outage exposure for business services rather than a data breach, making this a resilience and service-continuity risk that must be managed through interim mitigations until Cisco ships a patch.
No vendor-released patch identified at time of analysis. Interim mitigations to validate with Cisco TAC: rate-limit or suppress the high-volume syslog 419002 events that feed the affected rate-limiting path on ASA 9.16.x-9.23.x and FTD 7.0.x-7.7.x devices; deploy upstream SYN-flood defenses (SYN cookies, volumetric scrubbing, or edge ACL rate-limiting) so floods are absorbed before reaching the firewall; monitor CPU utilization and connection-handling metrics on exposed appliances with alerting for sustained spikes; and reduce reliance on a single affected appliance for critical traffic paths where architecture permits.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Multiple internally discovered incorrect-calculation flaws in Cisco Secure Firewall ASA Software, Secure Firewall Threat
Denial of service in Cisco Secure Firewall ASA and FTD Software allows a network-adjacent, unauthenticated attacker to r
Cisco Secure Firewall ASA and FTD software contain a logic error in the DNS over TCP response handler that can be trigge
Exploit-DB