Logic Error in DNS over TCP for Cisco Secure Firewall ASA and FTD Software
CVE-2026-20248

6.8MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Secure Firewall Adaptive Security Appliance (asa) Software
Cisco Secure Firewall Threat Defense (ftd) Software
Vendor
CVE Published:
16 September 2026

Badges

👾 Exploit Exists

What is CVE-2026-20248?

A logic error in the DNS over TCP implementation of Cisco Secure Firewall ASA and FTD Software allows unauthenticated attackers to exploit the TCP DNS response handler. By sending a specially crafted DNS reply, an attacker can trigger an unexpected restart of the device, leading to a denial of service (DoS) condition. This vulnerability requires the attacker to respond to DNS queries from the targeted device, either by controlling the DNS service or via a man-in-the-middle attack.

Affected Version(s)

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.1

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.1.28

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.16.2

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.