Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SSL VPN Denial of Service Vulnerability

In plain language

What this advisory means

A security flaw affects Cisco Secure Firewall devices running Adaptive Security Appliance (ASA) or Threat Defense (FTD) software. An attacker who is not logged in can overload the device’s memory by sending many new secure connection requests, causing the device’s VPN service to slow down or stop working. This is a denial of service (DoS) problem. Cisco has released software updates that fix this issue, but no other workarounds exist. To restore service quickly after an attack, manual device reload may be needed.

Technical explanation

How the issue affects the environment

The vulnerability exists in the VPN and management web servers of Cisco Secure Firewall ASA and FTD software platforms due to improper memory management of incoming SSL/TLS connections. An unauthenticated remote attacker can exploit this by sending a large volume of new SSL/TLS connection requests. This leads to exhaustion of system memory or buffer blocks, which causes SSL VPN connection processing to degrade significantly and eventually cease. Although memory or buffers can gradually be reclaimed after attack traffic stops, a manual device reload may be required for prompt recovery. Cisco has provided patched software releases to correct the underlying memory management flaw. No configuration workarounds are available.

Operational impact

Why teams should care

This vulnerability creates a high-impact denial of service risk to Cisco Secure Firewall devices managing SSL VPN connections. An attacker could remotely disrupt VPN services by exhausting device memory resources, causing connectivity loss or severe degradation. Service interruptions can affect secure access for remote users, potentially halting business operations relying on VPN. Recovery without patching may require manual device reloads, increasing downtime and operational costs.

Affected and fixed releases

Temporary risk reduction

There are no known workarounds that mitigate this vulnerability. Cisco advises applying the fixed software updates as the only effective remediation.

Evidence and validation checklist

• Cisco PSIRT advisory confirmation
• Description of memory exhaustion via SSL/TLS connections
• Official statement that no workarounds exist
• Release of fixed software versions
• Indicators of compromise include memory block leakage and degraded device performance