Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Web Services Denial of Service Vulnerability

TL;DR 📌

A buffer overflow vulnerability has been identified in the web services interface of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Software. This vulnerability allows unauthenticated remote attackers to cause a denial of service (DoS) condition. Cisco has released software updates to address this issue, and there are no workarounds available.

What happened 🕵️‍♂️

A vulnerability in the web services interface of Cisco Secure Firewall ASA and FTD Software could allow an unauthenticated, remote attacker to exploit a buffer overflow condition. This occurs due to insufficient boundary checks for specific data provided to the web services interface. An attacker could send a crafted HTTP request to the affected system, leading to a system reload and resulting in a denial of service (DoS).

Affected products 🖥️

The vulnerability affects:

• Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
• Cisco Secure Firewall Threat Defense (FTD) Software

Specific configurations that are vulnerable include:

• Management Web Server Access (http server enable)
• REST API (rest-api image disk0:/rest-api agent for ASA)
• HTTP server enabled for FTD (http server enable)

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds available that address this vulnerability.

Risk in context 🎯

With a CVSS score of 8.6, this vulnerability is rated as High. It is internet-facing and does not require authentication, making it particularly concerning for organizations. The potential for denial of service could impact availability, necessitating immediate attention.

Fast facts ⚡

• Vulnerability: Buffer overflow in web services interface
• CVSS Score: 8.6 (High)
• Impact: Denial of Service (DoS)
• Exploitation: Possible via crafted HTTP requests
• Workarounds: None available
• Fixed Software: Updates released by Cisco

For leadership 🧭

Executive summary. Any Cisco ASA or FTD device with the management web server, REST API, or HTTP server enabled can be knocked offline by a remote, unauthenticated attacker sending one crafted request, taking down the firewall itself. Because there is no workaround, patching is the only fix and should be scheduled as soon as a maintenance window allows.

Why it matters:

• The flaw sits in the web services interface used for management web server access, the REST API, and HTTP server functions on ASA and FTD, meaning any device with those features turned on is exposed.
• Exploitation requires no authentication and no user interaction — a single crafted HTTP request to the interface can trigger the buffer overflow.
• The result is a full device reload, which for a firewall means an outage in perimeter or segmentation enforcement, not just a service hiccup.
• No workaround exists, so devices with the affected configurations enabled remain exposed until the software is upgraded.

Now / Next / Later:

• Now:
• Next:
• Later: placeholder