SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20154

HIGH(8.6)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Risk Signal Score32/100 — MITTEL
  • CVSS 8.6 — Hoch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to improper rate limiting for syslog message 419002. An attacker could exploit this vulnerability by sending a flood of TCP synchronization (SYN) packets to an affected device. A successful exploit could allow the attacker to cause high CPU utilization, resulting in performance degradation. 

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detects high CPU utilization on Cisco ASA/FTD devices, potentially indicative of a DoS attack exploiting CVE-2026-20154. Requires monitoring of device performance metrics.

Sentinel/Defender KQL

CiscoASAEvent
| where SyslogMessageID == 419002
| summarize EventCount = count() by bin(TimeGenerated, 5m), DeviceName
| where EventCount > 1000 // Adjust threshold based on baseline
| project TimeGenerated, DeviceName, EventCount

Splunk SPL

sourcetype="cisco:asa" syslog_id="419002"
| timechart count by host
| where count > 1000 // Adjust threshold based on baseline

Sigma

title: Cisco ASA FTD DoS CVE-2026-20154
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential DoS attack against Cisco ASA/FTD via syslog message 419002 flood.
author: SecBoard
date: 2026/09/16
logsource:
  product: cisco
  service: asa
detection:
  selection:
    syslog_id: '419002'
  timeframe: 5m
  condition: selection | count() > 1000
  # Adjust threshold based on baseline
level: high

Elastic ES|QL

from cisco.asa.log
| where syslog_id == "419002"
| summarize event_count = count() by span(timestamp, 5m), host.name
| where event_count > 1000 // Adjust threshold based on baseline

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen