CVE-2010-0566 in ASA 5500
Summary
by MITRE
Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.0 before 7.0(8.10), 7.2 before 7.2(4.45), 8.0 before 8.0(4.44), 8.1 before 8.1(2.35), and 8.2 before 8.2(1.10) allows remote attackers to cause a denial of service (device reload) via a malformed TCP segment when certain NAT translation and Cisco AIP-SSM configurations are used, aka Bug ID CSCtb37219.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/01/2026
The vulnerability described in CVE-2010-0566 represents a critical denial of service flaw affecting Cisco ASA 5500 Series Adaptive Security Appliances running specific software versions. This issue manifests when the device processes malformed TCP segments under particular network configuration conditions involving NAT translation and Cisco AIP-SSM hardware modules. The vulnerability specifically impacts devices configured with certain NAT rules combined with AIP-SSM functionality, creating a scenario where crafted network traffic can trigger an immediate device reload operation.
The technical flaw resides in the ASA appliance's handling of malformed TCP segments within the context of specific network address translation configurations. When these vulnerable devices receive specially crafted TCP packets that contain malformed segment headers or unexpected sequence numbers, the device's processing logic fails to properly validate the incoming traffic. This validation failure causes the appliance to enter an unstable state where it automatically reboots the entire system. The vulnerability operates at the network protocol layer, specifically targeting the TCP processing engine within the ASA's security kernel, making it particularly dangerous as it can be exploited remotely without authentication requirements.
The operational impact of this vulnerability extends beyond simple service disruption to potentially compromising network availability and security posture. Organizations relying on these ASA appliances for network security may experience unexpected outages during critical operations, with the device requiring manual intervention to restore service. The automatic reload process can result in temporary loss of network security controls, leaving the network exposed to other threats during the recovery period. Additionally, the vulnerability affects multiple major software versions across different ASA series, indicating a widespread issue that would require extensive patch management across affected deployments.
This vulnerability aligns with CWE-119 which addresses "Improper Restriction of Operations within the Bounds of a Memory Buffer" and reflects patterns commonly seen in network device protocol processing flaws. The attack vector operates through the network layer using remote exploitation techniques consistent with ATT&CK tactic TA0040 (Defense Evasion) and technique T1499.004 (Endpoint Denial of Service). Organizations should prioritize immediate patching of affected systems, as the vulnerability can be exploited without authentication and provides complete control over the device's operational state. The remediation process requires careful planning due to the potential for service interruption during the patch deployment and system reboot cycles.