SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20250

HIGH(8.6)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Risk Signal Score32/100 — MITTEL
  • CVSS 8.6 — Hoch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in Datagram TLS (DTLS) message handling of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Cisco Secure Firewall 3100 Series and 4200 Series devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper resource management when processing certain DTLS messages. An attacker could exploit this vulnerability by sending a crafted stream of DTLS traffic to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detection for DTLS Denial of Service (DoS) vulnerability. Focus on unusual DTLS traffic patterns or device reloads.

Sentinel/Defender KQL

// Example: Monitor for sudden reloads or high CPU utilization on Cisco Secure Firewall devices
CiscoSecureFirewallEvents
| where EventType == "DeviceReload" or (EventType == "CpuUtilization" and CpuPercentage > 90)
| summarize count() by DeviceName, EventType, bin(TimeGenerated, 5m)
| where count_ > 5 // Adjust threshold as needed for reloads or sustained high CPU

Splunk SPL

# Example: Monitor for sudden reloads or high CPU utilization on Cisco Secure Firewall devices
index=cisco_firewall (event_type="DeviceReload" OR (event_type="CpuUtilization" cpu_percentage>90))
| timechart count by device_name, event_type
| where count > 5

Sigma

title: Cisco Secure Firewall DTLS DoS Anomaly
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential DTLS Denial of Service attempts on Cisco Secure Firewall devices by monitoring for device reloads or sustained high CPU.
author: SecBoard
date: 2026/09/16
logsource:
  product: cisco
  service: secure_firewall
detection:
  selection_reload:
    event_type: "DeviceReload"
  selection_cpu:
    event_type: "CpuUtilization"
    cpu_percentage: ">90"
  condition: selection_reload or selection_cpu
falsepositives:
  - "Planned reboots"
  - "Legitimate high CPU load"
level: high

Elastic ES|QL

// Example: Monitor for sudden reloads or high CPU utilization on Cisco Secure Firewall devices
FROM cisco_secure_firewall_logs
| WHERE event.type == "DeviceReload" OR (event.type == "CpuUtilization" AND cpu.percentage > 90)
| STATS count() BY device.name, event.type, span(timestamp, 5m)
| WHERE count > 5

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen