CVE-2026-20006

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20006", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.349Z", "datePublished": "2026-03-04T17:37:54.866Z", "dateUpdated": "2026-03-04T20:51:58.937Z"}, "containers": {"cna": {"title": "Cisco Firepower Threat Defense Software and Cisco FirePOWER Services TLS with Snort 3 Denial of Service Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "baseScore": 5.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in the TLS cryptography functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to unexpectedly restart, resulting in a denial of service (DoS) condition.\r\n\r\nThis vulnerability is due to improper implementation of the TLS protocol. An attacker could exploit this vulnerability by sending a crafted TLS packet to an affected system. A successful exploit could allow the attacker to cause a device that is running Cisco Secure FTD Software to drop network traffic, resulting in a DoS condition. \r\nNote: TLS 1.3 is not affected by this vulnerability."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-tcp-dos-rHfqnwRg", "name": "cisco-sa-ftd-tcp-dos-rHfqnwRg"}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-ftd-tcp-dos-rHfqnwRg", "discovery": "INTERNAL", "defects": ["CSCwn73801"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Error Handling", "type": "cwe", "cweId": "CWE-388"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "versions": [{"version": "7.2.0", "status": "affected"}, {"version": "7.2.0.1", "status": "affected"}, {"version": "7.2.1", "status": "affected"}, {"version": "7.3.0", "status": "affected"}, {"version": "7.2.2", "status": "affected"}, {"version": "7.2.3", "status": "affected"}, {"version": "7.3.1", "status": "affected"}, {"version": "7.2.4", "status": "affected"}, {"version": "7.2.5", "status": "affected"}, {"version": "7.2.4.1", "status": "affected"}, {"version": "7.3.1.1", "status": "affected"}, {"version": "7.4.0", "status": "affected"}, {"version": "7.2.5.1", "status": "affected"}, {"version": "7.4.1", "status": "affected"}, {"version": "7.2.6", "status": "affected"}, {"version": "7.4.1.1", "status": "affected"}, {"version": "7.2.7", "status": "affected"}, {"version": "7.2.5.2", "status": "affected"}, {"version": "7.3.1.2", "status": "affected"}, {"version": "7.2.8", "status": "affected"}, {"version": "7.6.0", "status": "affected"}, {"version": "7.4.2", "status": "affected"}, {"version": "7.2.8.1", "status": "affected"}, {"version": "7.4.2.1", "status": "affected"}, {"version": "7.2.9", "status": "affected"}, {"version": "7.4.2.2", "status": "affected"}, {"version": "7.2.10", "status": "affected"}, {"version": "7.6.1", "status": "affected"}, {"version": "7.4.2.3", "status": "affected"}, {"version": "7.6.2", "status": "affected"}, {"version": "7.6.2.1", "status": "affected"}, {"version": "7.4.2.4", "status": "affected"}, {"version": "7.2.10.2", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-04T17:37:54.866Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T20:51:52.748707Z", "id": "CVE-2026-20006", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T20:51:58.937Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20006", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T20:51:52.748707Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T20:51:55.949Z"}}], "cna": {"title": "Cisco Firepower Threat Defense Software and Cisco FirePOWER Services TLS with Snort 3 Denial of Service Vulnerability", "source": {"defects": ["CSCwn73801"], "advisory": "cisco-sa-ftd-tcp-dos-rHfqnwRg", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "versions": [{"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.2.0.1"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.3.0"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "7.2.3"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.2.4"}, {"status": "affected", "version": "7.2.5"}, {"status": "affected", "version": "7.2.4.1"}, {"status": "affected", "version": "7.3.1.1"}, {"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.2.5.1"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.6"}, {"status": "affected", "version": "7.4.1.1"}, {"status": "affected", "version": "7.2.7"}, {"status": "affected", "version": "7.2.5.2"}, {"status": "affected", "version": "7.3.1.2"}, {"status": "affected", "version": "7.2.8"}, {"status": "affected", "version": "7.6.0"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.2.8.1"}, {"status": "affected", "version": "7.4.2.1"}, {"status": "affected", "version": "7.2.9"}, {"status": "affected", "version": "7.4.2.2"}, {"status": "affected", "version": "7.2.10"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.4.2.3"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.6.2.1"}, {"status": "affected", "version": "7.4.2.4"}, {"status": "affected", "version": "7.2.10.2"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-tcp-dos-rHfqnwRg", "name": "cisco-sa-ftd-tcp-dos-rHfqnwRg"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the TLS cryptography functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to unexpectedly restart, resulting in a denial of service (DoS) condition.\r\n\r\nThis vulnerability is due to improper implementation of the TLS protocol. An attacker could exploit this vulnerability by sending a crafted TLS packet to an affected system. A successful exploit could allow the attacker to cause a device that is running Cisco Secure FTD Software to drop network traffic, resulting in a DoS condition. \r\nNote: TLS 1.3 is not affected by this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-388", "description": "Error Handling"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-03-04T17:37:54.866Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20006", "state": "PUBLISHED", "dateUpdated": "2026-03-04T20:51:58.937Z", "dateReserved": "2025-10-08T11:59:15.349Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-03-04T17:37:54.866Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Cisco Secure Firewall Threat Defense (FTD) Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.2.0.1"}, {"status": "affected", "version": "7.2.1"}, {"status": "affected", "version": "7.3.0"}, {"status": "affected", "version": "7.2.2"}, {"status": "affected", "version": "7.2.3"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "7.2.4"}, {"status": "affected", "version": "7.2.5"}, {"status": "affected", "version": "7.2.4.1"}, {"status": "affected", "version": "7.3.1.1"}, {"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.2.5.1"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.2.6"}, {"status": "affected", "version": "7.4.1.1"}, {"status": "affected", "version": "7.2.7"}, {"status": "affected", "version": "7.2.5.2"}, {"status": "affected", "version": "7.3.1.2"}, {"status": "affected", "version": "7.2.8"}, {"status": "affected", "version": "7.6.0"}, {"status": "affected", "version": "7.4.2"}, {"status": "affected", "version": "7.2.8.1"}, {"status": "affected", "version": "7.4.2.1"}, {"status": "affected", "version": "7.2.9"}, {"status": "affected", "version": "7.4.2.2"}, {"status": "affected", "version": "7.2.10"}, {"status": "affected", "version": "7.6.1"}, {"status": "affected", "version": "7.4.2.3"}, {"status": "affected", "version": "7.6.2"}, {"status": "affected", "version": "7.6.2.1"}, {"status": "affected", "version": "7.4.2.4"}, {"status": "affected", "version": "7.2.10.2"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "237462A2-E0CF-4201-9115-D94910F9745B", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "2CA2F5B0-0106-4FF2-91BD-AEF3F064F69E", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "EF9FFE56-9A00-456E-B097-114F714133BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "0E253A08-B4D4-4E81-9D5A-C15D198C43AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "59C7F868-1571-44CC-90E1-7A5EA01E63FC", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "7432B6F9-03CD-4373-B281-2A09864E7828", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "3D42B7E6-71ED-48BA-B11F-6791FE96C1B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "39CC3AC6-6F75-43BF-BBC9-F74AADB74716", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "FFBAC033-FF89-4581-92F6-EA4FFEE40F54", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "5AF3CB27-8315-452F-80E1-5DAF883319B1", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "7A910367-E5D5-4817-9DAA-3225D4FA8055", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.7:*:*:*:*:*:*:*", "matchCriteriaId": "38EC17C6-2DA5-4E26-987A-FD14F539F55B", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.8:*:*:*:*:*:*:*", "matchCriteriaId": "25E3D7DE-90EB-4531-BD7D-738637A83CD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "4E7FE2B9-65C0-4F7F-8810-72BFE861C521", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.9:*:*:*:*:*:*:*", "matchCriteriaId": "839E56CB-B466-4A38-A6E0-EBF27AA46315", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.10:*:*:*:*:*:*:*", "matchCriteriaId": "A90CFCD8-F873-4BEB-8193-97B62DB7FDA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.10.2:*:*:*:*:*:*:*", "matchCriteriaId": "677E2330-7FB5-4D91-9543-4941A8BE6A38", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "DD33999C-8DE7-4C0C-A8E5-1BA7127E36FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "A977F379-2F93-4A56-B0A6-C45AEF274123", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "DA7FA3B6-D630-42E3-B69F-B20D38B33531", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "9B125CC4-0DAE-4C26-9A27-2532BB09EA8A", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "5BC88149-095A-41DE-AA27-1CFD21125EF4", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "BA983223-35AE-4D2F-B2F5-BA0614908C3B", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "17A31A33-2E84-4C79-86BD-1E9FF4C1DD09", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "B58DC884-9430-49D4-AA8B-7FEB7505B7A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "5EC075D4-0033-46ED-9E55-576997424382", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "EA94FBB2-E095-48A3-BA39-5C2EC01D0ACA", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "D61D406F-6796-4E90-A954-285F6A3785AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "24DA7AE5-6288-4901-B9C9-36DF3788AA9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "E91D9CAD-174A-4AAE-AB14-BD3110F9CFA1", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "8EC515FD-4D9A-428D-9E72-9014C613A0E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "5B53EBBB-8E55-4D94-ADD3-C93630E09241", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_threat_defense:7.6.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "D9033AA9-2481-406A-8FBD-C671D3888D98", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the TLS cryptography functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to unexpectedly restart, resulting in a denial of service (DoS) condition.\r\n\r\nThis vulnerability is due to improper implementation of the TLS protocol. An attacker could exploit this vulnerability by sending a crafted TLS packet to an affected system. A successful exploit could allow the attacker to cause a device that is running Cisco Secure FTD Software to drop network traffic, resulting in a DoS condition. \r\nNote: TLS 1.3 is not affected by this vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad en la funcionalidad de criptograf\u00eda TLS del motor de detecci\u00f3n Snort 3 del software Cisco Secure Firewall Threat Defense (FTD) podr\u00eda permitir a un atacante remoto no autenticado provocar que el motor de detecci\u00f3n Snort 3 se reinicie inesperadamente, lo que resultar\u00eda en una condici\u00f3n de denegaci\u00f3n de servicio (DoS).\n\nEsta vulnerabilidad se debe a una implementaci\u00f3n incorrecta del protocolo TLS. Un atacante podr\u00eda explotar esta vulnerabilidad enviando un paquete TLS manipulado a un sistema afectado. Un exploit exitoso podr\u00eda permitir al atacante provocar que un dispositivo que ejecuta el software Cisco Secure FTD descarte el tr\u00e1fico de red, lo que resultar\u00eda en una condici\u00f3n de DoS.\nNota: TLS 1.3 no se ve afectado por esta vulnerabilidad."}], "id": "CVE-2026-20006", "lastModified": "2026-08-20T16:45:55.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20006", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T20:51:52.748707Z", "version": "2.0.3"}}]}, "published": "2026-03-04T18:16:13.803", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory", "Mitigation"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-tcp-dos-rHfqnwRg"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-388"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.3.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.3.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.8.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.4.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.6.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.6.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4.2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2.10.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Cisco Secure Firewall Threat Defense (FTD) Software", "source": "cna", "vendor": "Cisco"}, "product": "secure_firewall_threat_defense", "vendor": "cisco"}], "analysis": {"en": {"generated_at": "2026-04-16T13:22:36.709307+00:00", "value": {"mitigation_remediation": ["Install the latest Cisco Secure Firewall Threat Defense (FTD) Software that contains the TLS handling fix as described in the Cisco advisory.", "If a patch is not immediately available, restart the Snort\u00a03 Detection Engine or reboot the device to clear any abnormal state and restore service.", "Configure firewall rules or packet filters to limit or block suspicious TLS traffic until the software update is applied, reducing the exposure surface of the vulnerability."], "summary": {"action": "Patch Now", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Cisco Secure Firewall Threat Defense (FTD) Software is impacted. No specific product versions are listed in the advisory; therefore, all currently deployed FTD instances are potentially vulnerable unless documented otherwise by the vendor.", "description_and_impact": "A flaw in the TLS cryptography implementation of the Snort\u00a03 Detection Engine within Cisco Secure Firewall Threat Defense (FTD) Software enables an attacker to send a specially crafted TLS packet, causing the engine to unexpectedly restart. The resulting restart forces the device to drop network traffic, creating a denial of service condition. The weakness is classified as CWE\u2011388, an insecure interface or protocol vulnerability that can lead to service disruption.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 5.8, indicating moderate severity, and an EPSS score below 1\u202f%, implying a low likelihood of exploitation at present. The vulnerability is not present in Cisco\u2019s Known Exploited Vulnerabilities catalog. Based on the description, the attack vector is remote and unauthenticated: an external actor can target the affected firewall by transmitting the crafted TLS packet over a network connection. Successful exploitation would cause the Snort 3 engine to restart, leading to a denial of service that affects all traffic processed by the device."}}}}, "created": "2026-03-05T09:06:23.700077+00:00", "updated": "2026-04-16T13:30:16.049937+00:00", "vendors": ["cisco", "cisco$PRODUCT$secure_firewall_threat_defense"]}