OTPulse

Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service Vulnerability

MonitorCVSS 5.8cisco-sa-ftd-snort2-ssldos-Mw7WYX9cSep 16, 2026
CiscoEnergyManufacturing
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in SSL/TLS certificate parsing within the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense Software could allow an unauthenticated remote attacker to cause the Snort 2 Detection Engine to restart. The vulnerability stems from incomplete validation of SSL certificates during parsing. An attacker could exploit this by sending a crafted SSL connection setup request. A successful exploit results in a denial of service condition with the detection engine restarting unexpectedly. Cisco has released software updates that address this vulnerability. There are no workarounds available.

What this means
What could happen
An attacker can send a malformed SSL/TLS connection to your firewall, causing the Snort intrusion detection engine to restart. This causes a brief loss of threat detection and network inspection until the engine recovers.
Who's at risk
Organizations operating Cisco Secure Firewall appliances (Firepower series, ASA 5500-X, 3000 Series Industrial Security Appliances, or Secure Firewall 1200/3100/4200 Series) in energy and manufacturing sectors should prioritize this patch to maintain continuous network threat detection.
How it could be exploited
An attacker sends a specially crafted SSL/TLS certificate or connection request from the internet to your firewall's public-facing interface. The firewall's Snort 2 detection engine attempts to parse the malformed certificate, triggers a crash, and restarts. No authentication is required.
Prerequisites
  • Network connectivity to the firewall's internet-facing SSL/TLS inspection port (typically 443 or other HTTPS ports configured for inspection)
remotely exploitableno authentication requiredlow complexityaffects network security appliances used in critical infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (10)
10 with fix
ProductAffected VersionsFix Status
Firepower 2100 SeriesAll versionsFix available
Firepower 1000 SeriesAll versionsFix available
ASA 5500-X Series FirewallsAll versionsFix available
3000 Series Industrial Security Appliances (ISA)All versionsFix available
Firepower 9000 SeriesAll versionsFix available
Firepower 4100 SeriesAll versionsFix available
Secure Firewall Threat Defense VirtualAll versionsFix available
Secure Firewall 3100 SeriesAll versionsFix available
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply Cisco Secure Firewall software updates that patch the SSL/TLS certificate parsing vulnerability in Snort 2
View full vendor advisory
API: /api/v1/advisories/2f87f52b-8914-467e-bc3d-7ded7aa2e53e

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service Vulnerability | CVSS 5.8 - OTPulse