OTPulse

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Logging Denial of Service Vulnerability

Plan PatchCVSS 8.6cisco-sa-asa-ftd-logging-dos-ZXXNesfNSep 16, 2026
CiscoEnergyManufacturing
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in the system rate-limiting process for syslog message 419002 in Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to cause high CPU utilization by flooding the device with TCP SYN packets. Improper rate limiting of this specific syslog message enables the attacker to trigger excessive logging, degrading device performance and potentially causing denial of service. Cisco has released software updates and identified rate-limiting workarounds to address this vulnerability.

What this means
What could happen
An attacker can flood your firewall with SYN packets to trigger excessive syslog message generation, causing high CPU usage and performance degradation or shutdown of network traffic inspection capabilities. This can prevent legitimate traffic from reaching your facility while the firewall is overloaded.
Who's at risk
Energy and manufacturing organizations operating Cisco Secure Firewall appliances including ASA 5500-X Series, Firepower 1000/2100/4100/9000 Series, Secure Firewall 1200/3100/4200 Series, Industrial Security Appliances (ISA) 3000 Series, ASAv, and Secure Firewall Threat Defense Virtual should evaluate their exposure immediately, especially if these firewalls are internet-facing.
How it could be exploited
An attacker sends a flood of TCP SYN packets to the firewall from the internet. The firewall attempts to log message 419002 for each packet without proper rate limiting. The logging process consumes CPU resources faster than it can be handled, exhausting the device and preventing normal operations.
Prerequisites
  • Network access to the firewall from an external source (internet-facing device)
  • No authentication required
Remotely exploitableNo authentication requiredLow complexity attackHigh CVSS score (8.6)Internet-facing devices at risk
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (11)
11 with fix
ProductAffected VersionsFix Status
Firepower 2100 SeriesAll versionsFix available
Firepower 1000 SeriesAll versionsFix available
ASA 5500-X Series FirewallsAll versionsFix available
3000 Series Industrial Security Appliances (ISA)All versionsFix available
Firepower 9000 SeriesAll versionsFix available
Firepower 4100 SeriesAll versionsFix available
Adaptive Security Virtual Appliance (ASAv)All versionsFix available
Secure Firewall 3100 SeriesAll versionsFix available
Remediation & Mitigation
0/4
Do now
0/3
WORKAROUNDFor Cisco Secure Firewall ASA: configure 'logging rate-limit 100 1 message 419002' in global configuration mode to immediately limit syslog message 419002 to 100 messages per second
WORKAROUNDFor Cisco Secure FTD via Secure Firewall Management Center: navigate to Devices > Platform Settings > Rate Limit > Syslog Level and configure rate limiting for message 419002 to 100 messages per second, then deploy policies
WORKAROUNDFor Cisco Secure FTD via Firewall Device Manager: navigate to Device > System Settings > Logging and rate limit message 419002 to 100 messages per second
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate ASA Software or FTD Software to the patched versions provided by Cisco
View full vendor advisory
API: /api/v1/advisories/ac9a856a-446b-4040-b2ba-a5b3fa61e422

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.