Cisco Secure Firewall Adaptive Security Appliance Software SSL VPN buffer overflow

Summaryinfo

A vulnerability identified as critical has been detected in Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software. Affected by this vulnerability is an unknown functionality of the component SSL VPN. Performing a manipulation results in buffer overflow. This vulnerability is reported as CVE-2026-20100. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software (affected version not known). This affects some unknown functionality of the component SSL VPN. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on availability. The summary by CVE is:

A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a valid VPN connection to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This does not affect the management or MUS interfaces. This vulnerability is due to trusting user input without validation in the LUA interprerter. An attacker could exploit this vulnerability by sending crafted HTTP packets to the Remote Access SSL VPN server. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

The advisory is shared at sec.cloudapps.cisco.com. This vulnerability is uniquely identified as CVE-2026-20100 since 10/08/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 05/05/2026).

The vulnerability scanner Nessus provides a plugin with the ID 311458 (Cisco Firepower Threat Defense (FTD) Software VPN DoS Vulnerabilities (cisco-sa-asaftd-vpn-m9sx6MbC)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (311458). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Secure Firewall Adaptive Security Appliance Software
• Secure Firewall Threat Defense Software

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion