OTPulse

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software TCP DNS Denial of Service Vulnerability

MonitorCVSS 6.8cisco-sa-asaftd-tcpdns-dos-p6dUnjr5Sep 16, 2026
CiscoEnergyManufacturing
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

A vulnerability in DNS over TCP handling on Cisco Secure Firewall ASA and Threat Defense Software can cause the device to reload due to a buffer parsing logic error. An attacker positioned to respond to DNS queries from the affected device—by controlling the DNS server or via man-in-the-middle attack—can send a crafted DNS response to trigger the crash. This results in a denial of service affecting all traffic through the firewall. Cisco has released software updates; no workarounds are available.

What this means
What could happen
An attacker who can intercept or control DNS responses can force your firewall to reload, causing a temporary outage of all network traffic through that device and interrupting both data flow and security inspections.
Who's at risk
Energy and manufacturing operators using Cisco Secure Firewall (ASA, FTD, or 3000 Series ISA) as their perimeter defense or internal segmentation boundary. This includes both physical appliances (Firepower 1000, 2100, 4100, 9000 series, and newer Secure Firewall 200/1200/3100/4200/6100 series) and virtual instances (ASAv, FTD Virtual).
How it could be exploited
An attacker must position themselves to respond to DNS queries originating from your firewall—either by compromising your DNS server or by positioning themselves in the network path (man-in-the-middle). They then send a crafted DNS response that triggers a buffer parsing error, causing the firewall's DNS handler to crash and the device to reload.
Prerequisites
  • Network position to intercept or respond to DNS queries from the firewall (compromised DNS server or man-in-the-middle attack)
  • Firewall must be configured to query DNS over TCP (DNS over UDP is not vulnerable)
  • No authentication required
remotely exploitableno authentication requiredaffects network availability and critical security functionrequires specific network position but not high complexity attack
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (13)
13 with fix
ProductAffected VersionsFix Status
Firepower 2100 SeriesAll versionsFix available
Firepower 1000 SeriesAll versionsFix available
ASA 5500-X Series FirewallsAll versionsFix available
3000 Series Industrial Security Appliances (ISA)All versionsFix available
Firepower 9000 SeriesAll versionsFix available
Firepower 4100 SeriesAll versionsFix available
Adaptive Security Virtual Appliance (ASAv)All versionsFix available
Secure Firewall 3100 SeriesAll versionsFix available
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDRestrict DNS query sources to trusted internal DNS servers only; block outbound DNS to external resolvers if not required for operations
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply latest Cisco Secure Firewall ASA and Threat Defense software updates from Cisco
Long-term hardening
0/1
HARDENINGImplement network segmentation to prevent untrusted hosts from reaching the DNS servers your firewall queries
View full vendor advisory
API: /api/v1/advisories/2eed0b2d-886f-40fb-b68a-4deb25908642

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.