Product:
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
Summary
A vulnerability in the OSPF protocol could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. This vulnerability arises from insufficient input validation when processing OSPF link-state update packets. An attacker with the OSPF secret key could exploit this vulnerability by sending crafted OSPF packets.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.8 | CVE-2026-20025 |
Exploitation
To exploit this vulnerability, an attacker must be adjacent to the target network and possess the OSPF secret key. The attacker can then send specially crafted OSPF link-state update packets to the affected device. If successful, this could corrupt the heap memory of the device, leading to an unexpected reload and a denial of service condition.
Affected Products
- Cisco Secure Firewall ASA Software: Affected by the OSPF vulnerability that can lead to device reload.
- Cisco Secure FTD Software: Also vulnerable to the same OSPF issue, allowing for potential DoS attacks.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security patches provided by Cisco. Additionally, network segmentation and strict access controls should be implemented to limit the exposure of OSPF to untrusted networks.