SecBoard
Zurück zur CVE-Übersicht

CVE-2026-20295

HIGH(8.6)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Risk Signal Score32/100 — MITTEL
  • CVSS 8.6 — Hoch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, remote attacker to exhaust the available memory of an affected device. This vulnerability is due to improper management of memory resources during sftunnel TLS connection setup. An attacker could exploit this vulnerability by sending crafted sftunnel TLS frames to an affected device during the connection setup. A successful exploit could allow the attacker to exhaust the available memory on the affected device, which could result in a DoS condition.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

This vulnerability is due to improper management of memory resources during sftunnel TLS connection setup. An attacker could exploit this vulnerability by sending crafted sftunnel TLS frames to an affected device during the connection setup. A successful exploit could allow the attacker to exhaust the available memory on the affected device, which could result in a DoS condition.

Sentinel/Defender KQL

// Monitor for unusual memory consumption patterns on Cisco Secure FMC/FTD devices
// This query is a placeholder and requires specific logging for sftunnel TLS connection setup and memory usage.
// Look for sudden, sustained spikes in memory usage by sftunnel processes or the device as a whole.
DeviceProcessEvents
| where InitiatingProcessFileName == "sftunnel" or FileName == "sftunnel"
| where ActionType == "ProcessCreated"
| join kind=leftouter (
    DevicePerformanceEvents
    | where ObjectName == "Memory" and CounterName == "% Committed Bytes In Use"
    | summarize MaxMemoryUsage = max(CounterValue) by DeviceName, bin(Timestamp, 5m)
) on DeviceName
| where MaxMemoryUsage > 90 // Example threshold, adjust as needed
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, MaxMemoryUsage, ProcessCommandLine

Splunk SPL

# Monitor for unusual memory consumption patterns on Cisco Secure FMC/FTD devices
# This query is a placeholder and requires specific logging for sftunnel TLS connection setup and memory usage.
# Look for sudden, sustained spikes in memory usage by sftunnel processes or the device as a whole.
index=cisco_ftd_fmc sourcetype=sftunnel_logs OR sourcetype=cisco_memory_logs
| eval process_name = coalesce(process_name, "sftunnel")
| search process_name="sftunnel" OR (component="memory" AND usage>90) # Example threshold, adjust as needed
| timechart span=5m max(memory_usage) as max_memory_usage by host
| where max_memory_usage > 90

Sigma

title: Cisco FTD/FMC sftunnel Memory Exhaustion DoS
id: 00000000-0000-0000-0000-000000000000 # Placeholder: Generate a unique GUID
status: experimental
description: Detects potential memory exhaustion attacks against Cisco Secure FMC/FTD sftunnel protocol.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3
logsource:
  category: process_creation
  product: linux # Assuming Linux-based FTD/FMC, adjust if necessary
  service: auditd # Or other relevant logging service
detection:
  selection:
    Image|endswith: 'sftunnel'
    CommandLine|contains: 'tls'
  condition: selection
  timeframe: 5m
  level: high
falsepositives:
  - Legitimate sftunnel operations (requires baselining)

Elastic ES|QL

// Monitor for unusual memory consumption patterns on Cisco Secure FMC/FTD devices
// This query is a placeholder and requires specific logging for sftunnel TLS connection setup and memory usage.
// Look for sudden, sustained spikes in memory usage by sftunnel processes or the device as a whole.
from logs-cisco.ftd-*
| where process.name == "sftunnel" or process.executable == "sftunnel"
| where event.category == "process"
| join kind=leftouter (
    from metrics-cisco.ftd-*
    | where metric.name == "system.memory.usage.pct"
    | summarize max_memory_usage = max(metric.value) by host.name, span(timestamp, 5m)
) on host.name
| where max_memory_usage > 0.90 // Example threshold, adjust as needed (0.90 = 90%)
| project timestamp, host.name, process.name, process.command_line, max_memory_usage

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen