Improper input validation in Cisco Adaptive Security Appliance
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
A vulnerability in the Transport Layer Security (TLS) library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of the affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious TLS message to an interface enabled for Secure Layer Socket (SSL) services on an affected device. Messages using SSL Version 3 (SSLv3) or SSL Version 2 (SSLv2) cannot be be used to exploit this vulnerability. An exploit could allow the attacker to cause a buffer underflow, triggering a crash on an affected device. This vulnerability affects Cisco ASA Software and Cisco FTD Software that is running on the following Cisco products: Adaptive Security Virtual Appliance (ASAv), Firepower Threat Defense Virtual (FTDv), Firepower 2100 Series Security Appliance. Cisco Bug IDs: CSCve18902, CSCve34335, CSCve38446.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cisco Adaptive Security Appliance | Cisco Adaptive Security Appliance | — | No fix listed | CNA |
- Cisco Adaptive Security Appliance Vendor— Affected Cisco Adaptive Security Appliance Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8\(1\):*:*:*:*:*:*:* | 9.8(1) | Vulnerable | Cisco |
| cpe:2.3:o:cisco:adaptive_security_appliance_software:98.1\(1.154\):*:*:*:*:*:*:* | 98.1(1.154) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:* | 6.0 to before 6.1.0.6; 6.2.1 to before 6.2.2.1 | Vulnerable | Cisco |
- cpe:2.3:o:cisco:adaptive_security_appliance_software:9.8\(1\):*:*:*:*:*:*:* Versions 9.8(1) Vulnerable ·Cisco
- cpe:2.3:o:cisco:adaptive_security_appliance_software:98.1\(1.154\):*:*:*:*:*:*:* Versions 98.1(1.154) Vulnerable ·Cisco
- cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:* Versions 6.0 to before 6.1.0.6; 6.2.1 to before 6.2.2.1 Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-0231
- 2026-10-03 Alias added: GHSA-wq2j-24r5-rxj2
References
More Cisco Adaptive Security Appliance Software vulnerabilities
- TI-2025-14628 Buffer overflow in Cisco Secure Firewall Adaptive Security Appliance Software KEVCVSS 3.1CRITICAL 9.9
- TI-2016-05454 Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on… KEVCVSS 3.1HIGH 8.8
- TI-2023-06973 Authentication bypass in Cisco Adaptive Security Appliance Software KEVCVSS 3.1CRITICAL 9.1
- TI-2026-82192 Denial of service in Cisco Secure Firewall ASA and FTD SSL VPN KEVCVSS 3.1HIGH 8.6
- TI-2026-16533 Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense… KEVCVSS 3.1HIGH 8.6
- TI-2025-14657 Missing authorization in Cisco Secure Firewall Adaptive Security Appliance Software KEVCVSS 3.1HIGH 8.6
Sources
- CVE-2018-0231 · CVE Program
- CVE-2018-0231 · NVD
- FIRST EPSS
- GHSA-wq2j-24r5-rxj2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences