CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-20248
Advisory Summary
⬛ 🔔 Title: Cisco Secure Firewall ASA/FTD TCP DNS DoS via Unauthenticated Remote Trigger (CVE-2026-20248)
⚠️ What happened
Cisco disclosed a Medium security vulnerability in the DNS-over-TCP handling within Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. A remote, unauthenticated attacker can craft DNS responses/traffic that trigger a logic error, causing the TCP DNS response handler to restart unexpectedly, and ultimately the device to reload, resulting in a Denial of Service (DoS).
- The attacker must be able to respond to DNS queries made by the device, either by:
- controlling the upstream DNS service, or
- performing a man-in-the-middle (MITM) interception.
🧩 Root cause
A logic error in how DNS queries are parsed and how the system tracks incoming buffer sizes.
- Device reload → service disruption for security inspection, routing/firewall enforcement, and potentially dependent security workflows.
- Potential cascading outages where failover is not immediate or where logging/telemetry windows are lost.
- ✅ Cisco has released software updates that address the issue.
- ❌ Cisco reports no workarounds for this vulnerability.
🛠️ Actionable steps for market professionals
1. Inventory exposure: Identify all ASA/FTD deployments handling DNS over TCP (and those using DNS features that may hit the TCP path).
2. Prioritize patching: Apply the Cisco-provided updates as soon as maintenance windows allow, due to the lack of workarounds.
3. Validate DNS path: Review network controls around DNS traffic to reduce MITM risk (segmentation, DNS integrity monitoring, and trusted resolvers).
4. Operational readiness: Confirm HA/failover behavior and change-management rollback plans, since exploitation can lead to reloads.
- CVE: CVE-2026-20248
- Security Impact Rating: Medium
-2026-20248
Reference: Vendor Advisory