CVE-2026-20249

Vulnerability in DTLS message handling of Cisco Secure Firewall ASA and FTD Software for 3100 and 4200 Series devices allows an unauthenticated, remote attacker to cause a DoS condition. This is due to improper resource management when processing certain DTLS messages.

Vulnerability in the EIGRP implementation in Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, adjacent attacker to cause an unexpected device reload, resulting in a DoS condition. This is due to improper resource management when handling EIGRP update messages.

Vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to cause high CPU utilization, resulting in a DoS condition. This is due to improper rate limiting for syslog message 419002.

A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA and FTD software allows an authenticated, adjacent attacker to cause an unexpected device reload, resulting in a DoS condition. The issue is due to heap corruption when parsing OSPF packets.

A vulnerability in the Remote Access SSL VPN, HTTP management, and MUS functionality of Cisco Secure Firewall ASA and FTD Software could allow an unauthenticated, remote attacker to exhaust device memory, resulting in a denial of service (DoS) condition requiring a manual reboot. This is due to trusting user input without validation. An attacker could exploit this by sending crafted packets to the Remote Access SSL VPN server.

A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA and FTD Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device, potentially impacting availability of services to other devices in the network. This is due to a memory leak when parsing IKEv2 packets. An attacker could send crafted IKEv2 packets, exhausting resources and eventually requiring manual reload.

A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA and FTD Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device, potentially impacting availability of services to other devices in the network. This is due to memory exhaustion caused by not freeing memory during IKEv2 packet processing. An attacker could send crafted IKEv2 packets, exhausting resources and eventually requiring manual reload.