Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Firepower 3100 and 4200 Series TLS 1.3 Cipher Denial of Service Vulnerability

TL;DR 📌

A vulnerability in the TLS 1.3 implementation for Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Software on Firepower 3100 and 4200 Series devices could allow an authenticated remote attacker to cause a denial of service (DoS) condition. This affects the device’s ability to accept new SSL/TLS or VPN requests. Cisco has released software updates to address this issue, and there are workarounds available.

What happened 🕵️‍♂️

A vulnerability has been identified in the TLS 1.3 implementation for a specific cipher (TLS_CHACHA20_POLY1305_SHA256) used in Cisco Secure Firewall ASA and FTD Software. An authenticated remote attacker can exploit this vulnerability by sending numerous TLS 1.3 connections, leading to resource exhaustion and a denial of service (DoS) condition. Once in this state, the device will not accept new encrypted connections until it is rebooted.

Affected products 🖥️

• Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
• Cisco Secure Firewall Threat Defense (FTD) Software
• Cisco Firepower 3100 Series devices
• Cisco Firepower 4200 Series devices

Note: This vulnerability affects devices configured to allow the TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256, which is not the default configuration.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

A workaround to mitigate this vulnerability is available. Administrators can use the command no ssl cipher tlsv1.3 custom <cipher list> to remove the vulnerable cipher from the configuration. It is essential to evaluate the applicability and potential impact of this workaround in your specific environment before implementation.

Risk in context 🎯

With a CVSS score of 7.7, this vulnerability is rated as High. The exposure is primarily driven by the requirement for authentication, but the potential for denial of service could significantly impact availability. Immediate remediation is recommended, as exploitation could lead to service interruptions.

Fast facts ⚡

• Vulnerability: TLS 1.3 Cipher Denial of Service
• CVSS Score: 7.7 (High)
• Affected Devices: Firepower 3100 and 4200 Series with specific TLS configuration
• Impact: Denial of service, requiring device reboot
• Workaround: Remove the vulnerable cipher from configuration

For leadership 🧭

Executive summary. An authenticated attacker who can reach ASA or FTD software on Firepower 3100 or 4200 Series hardware can exhaust resources via the TLS_CHACHA20_POLY1305_SHA256 cipher, stopping the firewall from accepting new encrypted connections until it is rebooted. Devices configured to allow this non-default cipher should be patched or have the workaround applied in the next change window, treating it as a priority given the availability impact.

Why it matters:

• The attack targets the TLS 1.3 cipher TLS_CHACHA20_POLY1305_SHA256 on ASA and FTD software specifically on Firepower 3100 and 4200 Series appliances – other hardware or default configurations are not exposed.
• Once resource exhaustion is triggered, the firewall stops accepting new SSL/TLS or VPN connections entirely, cutting off remote access and encrypted traffic until an administrator reboots the device.
• Exploitation requires authentication, so the risk is concentrated among users or systems that already hold valid credentials to reach the affected TLS service, not anonymous internet scanners.
• Recovery is manual: there is no self-healing after the DoS condition triggers, meaning a reboot and operational disruption for however long that takes.

Now / Next / Later:

• Now: Check firewall configurations for Firepower 3100/4200 Series devices to confirm whether TLS_CHACHA20_POLY1305_SHA256 is enabled under the TLS 1.3 custom cipher list; if it is, apply the no ssl cipher tlsv1.3 custom <cipher list> workaround to remove it.
• Next: Schedule an upgrade of ASA or FTD software on affected Firepower 3100 and 4200 Series units to the fixed release during the next maintenance window, replacing the interim cipher workaround.
• Later: Review which TLS 1.3 ciphers are enabled by default versus explicitly configured across the firewall estate, and build cipher-suite review into standard firewall hardening checks to catch similar non-default exposures early.