CVE-2026-20248

MediumCVSS 6.8

Published: 16/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

28th percentile - higher than 28% of all known CVEs

Summary

A logic error when parsing a DNS query and tracking incoming buffer sizes in the DNS over TCP implementation of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated remote attacker to restart the TCP DNS response handler and reload the device. The attacker must be able to respond to DNS queries from the device, either by controlling the DNS service or through a machine-in-the-middle attack.

Risk Assessment

The device can be reloaded, causing a denial of service (DoS) condition that disrupts network protection. This poses a risk to firewall availability.

Recommendation

Apply the Cisco fix and secure DNS communication (e.g., DNSSEC, trusted DNS servers) against man-in-the-middle attacks.

Other vulnerabilities in Cisco Secure Firewall ASA and FTD Software

CVE-2024-20260High
A vulnerability in the VPN and management web servers of the Cisco Secure Firewall ASA Software and Cisco Secure FTD Software platforms could allow an unauthenticated, remote attacker to cause an affected device to run out of system memory or buffer blocks, which in turn could cause SSL VPN connection processing to slow down and eventually cease altogether. This vulnerability is due to a lack of proper memory management for new incoming SSL/TLS connections. An attacker could exploit this vulnerability by sending a large number of new incoming SSL/TLS connections to the targeted device, resulting in a denial of service (DoS) condition.

Original NVD description (English source)

A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the TCP DNS response handler to unexpectedly restart, causing the device to reload. This vulnerability is due to a logic error when parsing a DNS query and tracking the size of the incoming buffers. An attacker could exploit this vulnerability by formatting a crafted reply to a DNS query sent from the targeted device. A successful exploit could allow the attacker to cause the device to reload, causing a denial of service (DoS) condition. Note: The attacker must be able to respond to DNS queries from the device, either by controlling the DNS service or through a machine-in-the-middle attack.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS