OTPulse

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability

Plan PatchCVSS 8.6cisco-sa-asaftd-ikev2cert-dos-uWyc2xtvSep 16, 2026
CiscoEnergyManufacturing
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in the IKEv2 certificate authentication feature of Cisco Secure Firewall ASA and FTD software could allow an unauthenticated remote attacker to cause the affected device to reload unexpectedly. The vulnerability exists due to a logic error during the certificate authentication phase of IKEv2 connection setup. An attacker could exploit this by attempting to establish an IKEv2 VPN connection with a crafted certificate, causing the IKEv2 process to crash and triggering a denial of service condition.

What this means
What could happen
A remote attacker could crash your firewall's IKEv2 VPN process, causing it to reload. During this outage, VPN connectivity would be interrupted and your firewall would be unavailable to protect your network.
Who's at risk
Energy utilities and manufacturing facilities that rely on Cisco Secure Firewall appliances (Firepower series, ASA 5500-X series, 3000 Series Industrial Security Appliances, or newer Secure Firewall series) to protect network access and VPN connections to control systems and operations networks.
How it could be exploited
An attacker initiates an IKEv2 VPN connection attempt to your firewall from the internet and sends a specially crafted certificate during the authentication phase. The firewall's logic error causes the IKEv2 process to crash, reloading the device and dropping all active VPN sessions.
Prerequisites
  • Network access to IKEv2 port (UDP 500) on your firewall from an untrusted network
  • IKEv2 VPN configured and enabled on the firewall
remotely exploitableno authentication requiredlow complexityaffects firewall availabilityimpacts VPN connectivity
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (13)
13 with fix
ProductAffected VersionsFix Status
Firepower 2100 SeriesAll versionsFix available
Firepower 1000 SeriesAll versionsFix available
ASA 5500-X Series FirewallsAll versionsFix available
3000 Series Industrial Security Appliances (ISA)All versionsFix available
Firepower 9000 SeriesAll versionsFix available
Firepower 4100 SeriesAll versionsFix available
Adaptive Security Virtual Appliance (ASAv)All versionsFix available
Secure Firewall 3100 SeriesAll versionsFix available
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

3000 Series Industrial Security Appliances (ISA)
HOTFIXUpdate your firewall software to the patched version released by Cisco for your specific model (Firepower 2100/1000/9000/4100, ASA 5500-X, 3000 ISA, Secure Firewall 3100/4200/1200/200/6100, or Threat Defense Virtual)
View full vendor advisory
API: /api/v1/advisories/53bc3a7b-9390-4b08-ac74-a613bc38fb82

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.