Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software EIGRP Denial of Service Vulnerability
MonitorCVSS 7.4cisco-sa-asaftd-eigrp-dos-GOhNejSjSep 16, 2026
CiscoEnergyManufacturing
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
A vulnerability in EIGRP (Enhanced Interior Gateway Routing Protocol) handling in Cisco Secure Firewall devices could allow an unauthenticated attacker on an adjacent network segment to trigger a memory leak by sending crafted EIGRP update messages at high rates. The memory leak causes the firewall to eventually reload, creating a denial of service. Affected products include Firepower 2100/1000/9000/4100 Series, Secure Firewall 3100/4200/1200/200/6100 Series, ASAv, Threat Defense Virtual, and Management Center. Cisco has released software updates; there are no workarounds available.
What this means
What could happen
An attacker on the same network segment could crash your firewall by sending malicious EIGRP routing messages, causing it to reload and interrupt all traffic passing through it.
Who's at risk
Energy and manufacturing operations that use Cisco Secure Firewall appliances (ASA, FTD, or Secure Firewall hardware) as perimeter firewalls or security gateways. This includes all Cisco firewall platforms from the 200 Series through Firepower 9000 Series and virtual instances. Any facility relying on these firewalls for network access control is affected.
How it could be exploited
An attacker with network access to your firewall sends a stream of crafted EIGRP update packets to the device. The firewall's EIGRP handler leaks memory with each malicious packet until the device runs out of memory and crashes. The attacker does not need authentication or special credentials.
Prerequisites
- Network access to the firewall from an adjacent network segment (same VLAN or routing domain)
- EIGRP enabled on the firewall
- No authentication required
remotely exploitableno authentication requiredlow complexityadjacent network accesscauses device reload
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (13)
13 with fix
ProductAffected VersionsFix Status
Firepower 2100 SeriesAll versionsFix available
Firepower 1000 SeriesAll versionsFix available
3000 Series Industrial Security Appliances (ISA)All versionsFix available
Firepower 9000 SeriesAll versionsFix available
Firepower 4100 SeriesAll versionsFix available
Adaptive Security Virtual Appliance (ASAv)All versionsFix available
Secure Firewall 3100 SeriesAll versionsFix available
Secure Firewall 4200 SeriesAll versionsFix available
Remediation & Mitigation
0/15
Do now
0/23000 Series Industrial Security Appliances (ISA)
WORKAROUNDIf EIGRP is not required, disable EIGRP on the firewall to prevent exploitation
All products
HARDENINGRestrict EIGRP traffic (port 5 for IP protocol number 88) from untrusted network segments using access lists or network segmentation
Schedule — requires maintenance window
0/13Patching may require device reboot — plan for process interruption
Firepower 2100 Series
HOTFIXUpdate Firepower 2100 Series to patched version
Firepower 1000 Series
HOTFIXUpdate Firepower 1000 Series to patched version
Firepower 9000 Series
HOTFIXUpdate Firepower 9000 Series to patched version
Firepower 4100 Series
HOTFIXUpdate Firepower 4100 Series to patched version
Adaptive Security Virtual Appliance (ASAv)
HOTFIXUpdate ASAv (Adaptive Security Virtual Appliance) to patched version
Secure Firewall 3100 Series
HOTFIXUpdate Secure Firewall 3100 Series to patched version
Secure Firewall 4200 Series
HOTFIXUpdate Secure Firewall 4200 Series to patched version
Secure Firewall 1200 Series
HOTFIXUpdate Secure Firewall 1200 Series to patched version
Secure Firewall 200 Series
HOTFIXUpdate Secure Firewall 200 Series to patched version
Secure Firewall 6100 Series
HOTFIXUpdate Secure Firewall 6100 Series to patched version
Secure Firewall Threat Defense Virtual
HOTFIXUpdate Secure Firewall Threat Defense Virtual to patched version
Secure Firewall Management Center (FMC)
HOTFIXUpdate Secure Firewall Management Center (FMC) to patched version
All products
HOTFIXUpdate 3000 Series Industrial Security Appliances to patched version
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/1651d027-19b1-4faa-b612-ff466ad6bd40Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.