Intel

CVE-2026-20248

Eine Schwachstelle in der DNS über TCP-Implementierung der Cisco Secure Firewall Adaptive Security Appliance (ASA) Software und der Cisco…

mediumEPSS 0.3%

Description

A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the TCP DNS response handler to unexpectedly restart, causing the device to reload. This vulnerability is due to a logic error when parsing a DNS query and tracking the size of the incoming buffers. An attacker could exploit this vulnerability by formatting a crafted reply to a DNS query sent from the targeted device. A successful exploit could allow the attacker to cause the device to reload, causing a denial of service (DoS) condition. Note: The attacker must be able to respond to DNS queries from the device, either by controlling the DNS service or through a machine-in-the-middle attack.

Source: BSI CSAFBSI WID Portalcvelistv5cisco_csafNVD (NIST)CVE.org (MITRE)

Metrics

XIEM Effective CVSS
6.8
Source: nvd-v3
EPSS percentile
25.4 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
medium
Priority score
69.16
Exploit maturity
no public PoC known
CVSS v3
6.8
EPSS score
0.3 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-09-16 21:17 UTC
CWE
CWE-195

Weakness classes (CWE)

  • CWE-195Variant

    Signed to Unsigned Conversion Error

    The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-09-17 14:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-20248","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
  2. New CVE Received2026-09-16 21:17 UTC· psirt@cisco.com
    • Description: A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the TCP DNS&nbsp;response handler to unexpectedly restart, causing the device to reload. This vulnerability is due to a logic error when parsing a DNS query and tracking the size of the incoming buffers. An attacker could exploit this vulnerability by formatting a crafted reply to a DNS query sent from the targeted device. A successful exploit could allow the attacker to cause the device to reload, causing a denial of service (DoS) condition. Note: The attacker must be able to respond to DNS queries from the device, either by controlling the DNS service or through a machine-in-the-middle attack.
    • CVSS V3.1: AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
    • CWE: CWE-195
    • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/20xxx/CVE-2026-20248.json">CVE-2026-20248</a>

Linked advisories