Read the docs
TI-2021-13788 Aliases CVE-2021-34790GHSA-g7jg-fgxx-4vv5

Improper input validation in Cisco Adaptive Security Appliance Software

Priority LOW 26CWE-358Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host located behind the ALG. For more information about these vulnerabilities, see the Details section of this advisory. Note: These vulnerabilities have been publicly discussed as NAT Slipstreaming.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01145 66th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Adaptive Security Appliance (ASA) Softwareall versions—No fix listedCNA
  • Cisco Adaptive Security Appliance (ASA) Software VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*before 9.8.4.40VulnerableCisco
cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*before 6.4.0.12; 6.5.0 to before 6.6.5; 6.7.0 to before 6.7.0.2VulnerableCisco
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*9.12.0 to before 9.12.4.29; 9.13.0 to before 9.14.2.15; 9.15.0 to before 9.15.1.15VulnerableCisco
cpe:2.3:o:cisco:asa_5512-x_firmware:009.008:*:*:*:*:*:*:*009.008VulnerableCisco
cpe:2.3:o:cisco:asa_5512-x_firmware:009.015:*:*:*:*:*:*:*009.015VulnerableCisco
cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:asa_5505_firmware:009.008:*:*:*:*:*:*:*009.008VulnerableCisco
cpe:2.3:o:cisco:asa_5505_firmware:009.015:*:*:*:*:*:*:*009.015VulnerableCisco
cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:asa_5515-x_firmware:009.008:*:*:*:*:*:*:*009.008VulnerableCisco
  • cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:* Versions before 9.8.4.40 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:* Versions before 6.4.0.12; 6.5.0 to before 6.6.5; 6.7.0 to before 6.7.0.2 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* Versions 9.12.0 to before 9.12.4.29; 9.13.0 to before 9.14.2.15; 9.15.0 to before 9.15.1.15 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_5512-x_firmware:009.008:*:*:*:*:*:*:* Versions 009.008 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_5512-x_firmware:009.015:*:*:*:*:*:*:* Versions 009.015 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:asa_5505_firmware:009.008:*:*:*:*:*:*:* Versions 009.008 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_5505_firmware:009.015:*:*:*:*:*:*:* Versions 009.015 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:asa_5515-x_firmware:009.008:*:*:*:*:*:*:* Versions 009.008 Vulnerable ·Cisco
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:cisco:asa_5515-x_firmware:009.015:*:*:*:*:*:*:*009.015VulnerableCisco
cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:asa_5525-x_firmware:009.008:*:*:*:*:*:*:*009.008VulnerableCisco
cpe:2.3:o:cisco:asa_5525-x_firmware:009.015:*:*:*:*:*:*:*009.015VulnerableCisco
cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:asa_5545-x_firmware:009.008:*:*:*:*:*:*:*009.008VulnerableCisco
cpe:2.3:o:cisco:asa_5545-x_firmware:009.015:*:*:*:*:*:*:*009.015VulnerableCisco
cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:asa_5555-x_firmware:009.008:*:*:*:*:*:*:*009.008VulnerableCisco
cpe:2.3:o:cisco:asa_5555-x_firmware:009.015:*:*:*:*:*:*:*009.015VulnerableCisco
cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:asa_5580_firmware:009.008:*:*:*:*:*:*:*009.008VulnerableCisco
cpe:2.3:o:cisco:asa_5580_firmware:009.015:*:*:*:*:*:*:*009.015VulnerableCisco
cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:asa_5585-x_firmware:009.008:*:*:*:*:*:*:*009.008VulnerableCisco
cpe:2.3:o:cisco:asa_5585-x_firmware:009.015:*:*:*:*:*:*:*009.015VulnerableCisco
cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:o:cisco:asa_5515-x_firmware:009.015:*:*:*:*:*:*:* Versions 009.015 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:asa_5525-x_firmware:009.008:*:*:*:*:*:*:* Versions 009.008 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_5525-x_firmware:009.015:*:*:*:*:*:*:* Versions 009.015 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:asa_5545-x_firmware:009.008:*:*:*:*:*:*:* Versions 009.008 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_5545-x_firmware:009.015:*:*:*:*:*:*:* Versions 009.015 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:asa_5555-x_firmware:009.008:*:*:*:*:*:*:* Versions 009.008 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_5555-x_firmware:009.015:*:*:*:*:*:*:* Versions 009.015 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:asa_5580_firmware:009.008:*:*:*:*:*:*:* Versions 009.008 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_5580_firmware:009.015:*:*:*:*:*:*:* Versions 009.015 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:asa_5585-x_firmware:009.008:*:*:*:*:*:*:* Versions 009.008 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_5585-x_firmware:009.015:*:*:*:*:*:*:* Versions 009.015 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Cisco Adaptive Security Appliance (ASA) Software — 20211027 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Application Level Gateway Bypass Vulnerabilities

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-13789 Improper input validation in Cisco Adaptive Security Appliance SoftwarePriority LOW 26
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-34790
  2. 2026-10-03 Alias added: GHSA-g7jg-fgxx-4vv5

References

Advisory 1

  • TI-2020-02861 Uncontrolled resource consumption in Cisco Adaptive Security Appliance Software CVSS 3.1HIGH 8.6
  • TI-2021-17312 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Denial of Service Vulnerability CVSS 3.1HIGH 8.6
  • TI-2020-03115 Uncontrolled resource consumption in Cisco Adaptive Security Appliance Software CVSS 3.1HIGH 8.6
  • TI-2020-03075 Uncontrolled resource consumption in Cisco Adaptive Security Appliance Software CVSS 3.1HIGH 8.6
  • TI-2020-02985 Unrestricted file upload in Cisco Adaptive Security Appliance Software CVSS 3.1HIGH 8.6
  • TI-2021-17313 Stack-based buffer overflow in Cisco Adaptive Security Appliance Software CVSS 3.1HIGH 8.6
See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences