SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20135

HIGH(8.6)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Risk Signal Score32/100 — MITTEL
  • CVSS 8.6 — Hoch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper buffer management during the TLS 1.3 connection. An attacker could exploit this vulnerability by sending a crafted TLS 1.3 packet to an affected system through a TLS 1.3-enabled listening socket. A successful exploit could allow the attacker to cause the LINA process to crash, which would cause the device to reload. The reload can happen before or after authentication of the connection.Note: TLS 1.3 connections include both data traffic and user-management traffic.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceNetworkEvents
| where ActionType == "ConnectionInitiated"
| where RemotePort == 443 or RemotePort == 8443 // Or other TLS 1.3 enabled ports
| where Protocol == "Tcp"
| where InitiatingProcessFileName has_any ("lina", "ftd") // Assuming LINA process or FTD software initiates/handles TLS
| summarize ConnectionCount = count() by DeviceName, RemoteIP, RemotePort
| where ConnectionCount > 50 // Threshold for potential DoS attempts, adjust as needed
| project DeviceName, RemoteIP, RemotePort, ConnectionCount

Splunk SPL

sourcetype=cisco:ftd (dest_port=443 OR dest_port=8443) proto=tcp | stats count as ConnectionCount by host, src_ip, dest_port | where ConnectionCount > 50

Sigma

title: Cisco FTD TLS 1.3 DoS Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential DoS attempts against Cisco FTD devices via crafted TLS 1.3 packets.
author: SecBoard
date: 2026/09/16
logsource:
  product: cisco
  service: ftd
detection:
  selection:
    dest_port: [443, 8443] # Or other TLS 1.3 enabled ports
    protocol: tcp
  timeframe: 1m
  condition: selection | count() > 50 # Threshold for potential DoS attempts, adjust as needed
level: high

Elastic ES|QL

from network where event.kind == "event" and (destination.port == 443 or destination.port == 8443) and network.transport == "tcp" and process.name in ("lina", "ftd") | summarize connection_count = count() by host.name, source.ip, destination.port | where connection_count > 50

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen