OTPulse

Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability

Plan PatchCVSS 8.6cisco-sa-ftd-tls1.3-dos-dLxwFWgFSep 16, 2026
CiscoEnergyManufacturingTransportation
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in TLS 1.3 implementation in Cisco Secure Firewall Threat Defense Software allows an unauthenticated remote attacker to cause an affected firewall to crash and reload by sending a crafted TLS 1.3 packet to any TLS 1.3-enabled listening socket (management or data port). The crash is caused by improper buffer management in the TLS 1.3 connection handler. Affected products include Firepower (1000, 2100, 4100, 9000 series), ASA 5500-X, Secure Firewall (1200, 3100, 4200 series), Secure Firewall Threat Defense Virtual, and 3000 Series Industrial Security Appliances.

What this means
What could happen
An attacker can send a specially crafted TLS 1.3 packet to your firewall, causing it to crash and reload, interrupting all traffic filtering and network protection during the outage.
Who's at risk
Energy and manufacturing operators that rely on Cisco Firepower or ASA firewalls for network protection and OT/IT boundary security. This includes any site running Firepower 1000/2100/4100/9000 series, ASA 5500-X, Secure Firewall 1200/3100/4200 series, or Industrial Security Appliances (ISA)—any interruption to these devices will disrupt all downstream network filtering and leave operations vulnerable.
How it could be exploited
An attacker sends a malicious TLS 1.3 packet to a TLS 1.3-enabled port on your firewall (either a management or data port). This packet triggers a buffer overrun in the firewall's LINA process, causing it to crash. The firewall then reloads, during which all network traffic is unfiltered and unprotected.
Prerequisites
  • Network access to a TLS 1.3-enabled listening port on the affected firewall (management or data interface)
  • No authentication required
Remotely exploitableNo authentication requiredLow complexityHigh CVSS score (8.6)Affects network security appliancesCan cause operational downtime
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (10)
10 with fix
ProductAffected VersionsFix Status
Firepower 2100 SeriesAll versionsFix available
Firepower 1000 SeriesAll versionsFix available
ASA 5500-X Series FirewallsAll versionsFix available
3000 Series Industrial Security Appliances (ISA)All versionsFix available
Firepower 9000 SeriesAll versionsFix available
Firepower 4100 SeriesAll versionsFix available
Secure Firewall Threat Defense VirtualAll versionsFix available
Secure Firewall 3100 SeriesAll versionsFix available
Remediation & Mitigation
0/10
Schedule — requires maintenance window
0/10

Patching may require device reboot — plan for process interruption

Firepower 2100 Series
HOTFIXUpdate Firepower 2100 Series to patched version
Firepower 1000 Series
HOTFIXUpdate Firepower 1000 Series to patched version
ASA 5500-X Series Firewalls
HOTFIXUpdate ASA 5500-X Series Firewalls to patched version
3000 Series Industrial Security Appliances (ISA)
HOTFIXUpdate 3000 Series Industrial Security Appliances (ISA) to patched version
Firepower 9000 Series
HOTFIXUpdate Firepower 9000 Series to patched version
Firepower 4100 Series
HOTFIXUpdate Firepower 4100 Series to patched version
Secure Firewall Threat Defense Virtual
HOTFIXUpdate Secure Firewall Threat Defense Virtual to patched version
Secure Firewall 3100 Series
HOTFIXUpdate Secure Firewall 3100 Series to patched version
Secure Firewall 4200 Series
HOTFIXUpdate Secure Firewall 4200 Series to patched version
Secure Firewall 1200 Series
HOTFIXUpdate Secure Firewall 1200 Series to patched version
View full vendor advisory
API: /api/v1/advisories/19524dca-16d9-456f-8267-21320f84744e

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.