Product:
Cisco Secure Firewall
Summary
A vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This is due to the allocation of an insufficiently sized block of memory. An attacker could exploit this vulnerability by sending crafted GCM-encrypted IPsec traffic to an affected device, potentially causing an unexpected reload and resulting in a DoS condition.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.7 | CVE-2026-20049 |
Exploitation
To exploit this vulnerability, an attacker must have valid credentials to establish a VPN connection with the affected device. Once connected, the attacker can send specially crafted GCM-encrypted IPsec traffic to the device, which may lead to a denial of service by causing the device to unexpectedly reload.
Affected Products
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
- Cisco Secure Firewall Threat Defense (FTD) Software
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security patches provided by Cisco for the affected products. Additionally, monitoring network traffic for unusual patterns and ensuring that only authorized users have access to the VPN can help reduce the risk of exploitation.