Denial of Service Affecting Cisco Secure Firewall ASA and FTD via Remote Access SSL VPN Service
A vulnerability affecting Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD) would allow an unauthenticated, remote attacker to send a crafted HTTP request to the remote access SSL VPN service and cause the device to unexpectedly reload, resulting in a denial of service (DoS) condition.
Description
Technical context and vulnerability details
Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD) are network security solutions developed by Cisco allowing in particular the protection of infrastructures and the implementation of remote access VPN services. These solutions are affected by a vulnerability labeled CVE-2026-20349, resulting from insufficient error checking when processing HTTP requests by the Remote Access SSL VPN service. Exploitation of this vulnerability would allow a remote, unauthenticated attacker to send a specially crafted HTTP request to the affected service and cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is classified high, with a severity score of 8.6 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Denial of service of the affected firewall;
- Unexpected equipment reload;
- Disruption of remote access VPN services;
- Impairment of availability of protected network services;
Affected systems
Products, components and targeted versions
- Versions of Cisco Secure Firewall ASA Software affected by the Cisco advisory, including branches 9.16, 9.18, 9.20, 9.22, 9.23 and 9.24;
- Affected Cisco Secure Firewall Threat Defense (FTD) versions, including branches 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD) to patched versions recommended by Cisco;
- Apply the quick fixes corresponding to the version used;
- Check logs for possible exploit attempts or unexpected reloads;
- Monitor VPN services for abnormal activity;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.