CVE-2026-20022
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated adjacent attacker to cause an unexpected device reload, resulting in a DoS condition when OSPF canonicalization debug is enabled. This is due to insufficient input validation when processing OSPF LSU packets.
Risk Assessment
An attacker can send crafted OSPF packets, causing memory write outside packet data and device reload, leading to service disruption.
Recommendation
Install Cisco updates. Disable OSPF canonicalization debug if not needed, and restrict access to the OSPF network.
Other vulnerabilities in Cisco Secure Firewall
See all- CVE-2026-20023Medium
A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated adjacent attacker to corrupt memory on an affected device, resulting in a DoS condition. This is due to memory corruption when parsing OSPF protocol packets.
- CVE-2026-20008Medium
A vulnerability in a subset of CLI commands on Cisco Secure Firewall ASA and FTD Software allows an authenticated local attacker with administrator privileges to craft Lua code that could be used on the underlying operating system as root. This exists because user-provided input is not properly sanitized.
Original NVD description (English source)
A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition when OSPF canonicalization debug is enabled by using the command debug ip ospf canon. This vulnerability is due to insufficient input validation when processing OSPF LSU packets. An attacker could exploit this vulnerability by sending crafted unauthenticated OSPF packets. A successful exploit could allow the attacker to write to memory outside of the packet data, causing the device to reload, resulting in a DoS condition.