OTPulse

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Secure Firewall 3100 and 4200 Series DTLS Denial of Service Vulnerability

Plan PatchCVSS 8.6cisco-sa-asaftd-dtls-dos-Kp57HkyOSep 16, 2026
CiscoTransportation
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in DTLS message handling in Cisco Secure Firewall ASA and FTD Software for 3100 and 4200 Series devices allows an unauthenticated remote attacker to cause a denial of service by sending crafted DTLS traffic. Improper resource management when processing these messages can cause the device to reload, interrupting all security filtering and network traffic. Cisco has released patches and provided a workaround (disabling DTLS flow offload via CLI) to address the issue.

What this means
What could happen
An attacker could send crafted DTLS traffic to cause a Secure Firewall device to reload, interrupting all traffic inspection and security enforcement until the device recovers. This results in a complete loss of firewall protection for the network segment during the outage.
Who's at risk
Organizations running Cisco Secure Firewall 3100 or 4200 Series devices as perimeter security gateways, especially those using VPN or IPsec termination with DTLS sessions. This affects any transportation, utilities, or enterprise environment relying on these firewalls for network protection.
How it could be exploited
An attacker sends a crafted stream of DTLS (Datagram TLS) packets to the firewall's network interface from an external network. The device improperly manages resources when processing these messages, exhausting resources or triggering an internal error that forces a device reload. No authentication or complex network positioning is required—the attacker only needs network reachability to the firewall's IP address.
Prerequisites
  • Network reachability to the Secure Firewall device on the DTLS port (typically port 443 or custom VPN ports)
  • No authentication required; the device accepts DTLS traffic without credentials
remotely exploitableno authentication requiredlow complexityhigh CVSS score (8.6)affects critical network security boundary
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Secure Firewall 3100 SeriesAll versionsFix available
Secure Firewall 4200 SeriesAll versionsFix available
Remediation & Mitigation
0/4
Do now
0/2
WORKAROUNDAs an immediate mitigation, execute the CLI command 'no flow-offload-dtls' to disable DTLS flow offload processing on the affected firewall
WORKAROUNDFor FTD devices, deploy the 'no flow-offload-dtls' command via FlexConfig if CLI access is not available
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Cisco Secure Firewall ASA Software and FTD Software to the patched version released by Cisco for your device model (3100 or 4200 Series)
Long-term hardening
0/1
HARDENINGAfter applying the workaround, monitor device CPU utilization and throughput to assess performance impact in your deployment; be prepared to schedule maintenance for the vendor patch if the workaround degrades performance
View full vendor advisory
API: /api/v1/advisories/a8b2c90e-ef95-4b1a-a3bb-2034e2f3670b

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Secure Firewall 3100 and 4200 Series DTLS Denial of Service Vulnerability | CVSS 8.6 - OTPulse