Read the docs
TI-2019-01341 Aliases CVE-2019-1715GHSA-f5gw-c8rq-f9v2

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability

Priority MEDIUM 42CWE-332Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. The vulnerability is due to insufficient entropy in the DRBG when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01726 77th percentileScored 2026-11-07
Fix Fixed Cisco Adaptive Security Appliance (ASA) Software (Cisco): 9.8.4, 9.9.2.50Cisco Firepower Threat Defense (FTD) Software (Cisco): 6.2.3.12, 6.3.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Adaptive Security Appliance (ASA) Softwarebefore 9.8.4; before 9.9.2.509.8.4, 9.9.2.50Patch availableCNA
CiscoCisco Firepower Threat Defense (FTD) Softwarebefore 6.2.3.12; before 6.3.0.36.2.3.12, 6.3.0.3Patch availableCNA
  • Cisco Adaptive Security Appliance (ASA) Software VendorCisco Affected before 9.8.4; before 9.9.2.50 Fixed in 9.8.4, 9.9.2.50 Patch available CNA
  • Cisco Firepower Threat Defense (FTD) Software VendorCisco Affected before 6.2.3.12; before 6.3.0.3 Fixed in 6.2.3.12, 6.3.0.3 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:*:*:*:*:*:*:*:*9.8 to before 9.8.4; 9.9 to before 9.9.2.50VulnerableCisco
cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*6.2.1 to before 6.2.3.12; 6.3.0 to before 6.3.0.3VulnerableCisco
cpe:2.3:h:cisco:asa-5506-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:asa-5506h-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:asa-5506w-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:asa-5508-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:asa-5516-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:asa-5525-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:asa-5545-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:h:cisco:asa-5555-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:*:*:*:*:*:*:*:* Versions 9.8 to before 9.8.4; 9.9 to before 9.9.2.50 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:* Versions 6.2.1 to before 6.2.3.12; 6.3.0 to before 6.3.0.3 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:asa-5506-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:asa-5506h-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:asa-5506w-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:asa-5508-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:asa-5516-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:asa-5525-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:asa-5545-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:h:cisco:asa-5555-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:cisco:asa_5500:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:h:cisco:asa_5500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

  • Fix · CNA Cisco Adaptive Security Appliance (ASA) Software (Cisco) Fixed in 9.8.4, 9.9.2.50
  • Fix · CNA Cisco Firepower Threat Defense (FTD) Software (Cisco) Fixed in 6.2.3.12, 6.3.0.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Cisco Firepower Threat Defense (FTD) Software 6.2.3.12, 6.3.0.3

    8 records Highest priority Priority MEDIUM 4 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2019-01320 Improper input validation in Cisco Adaptive Security Appliance SoftwarePriority MEDIUM 48
    • TI-2019-01340 Credentials management flaw in Cisco Adaptive Security Appliance SoftwarePriority MEDIUM 47
    • TI-2019-01334 Memory leak in Cisco Adaptive Security Appliance SoftwarePriority MEDIUM 47
    Show all 8 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1715
  2. 2026-10-03 Alias added: GHSA-f5gw-c8rq-f9v2

References

Advisory 1

  • TI-2013-01038 The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8, and Cisco… CVSS 2.0HIGH 9.3
  • TI-2007-00387 The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and… CVSS 2.0MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences