CVE-2021-1422: Cisco Adaptive Security Appliance Software Release 9.16.1 and Cisco Firepower Threat Defense Software Release 7.0.0 IPsec Denial of Service Vulnerability
A vulnerability in the software cryptography module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker or an unauthenticated attacker in a man-in-the-middle position to cause an unexpected reload of the device that results in a denial of service (DoS) condition. The vulnerability is due to a logic error in how the software cryptography module handles specific types of decryption errors. An attacker could exploit this vulnerability by sending malicious packets over an established IPsec connection. A successful exploit could cause the device to crash, forcing it to reload. Important: Successful exploitation of this vulnerability would not cause a compromise of any encrypted data. Note: This vulnerability affects only Cisco ASA Software Release 9.16.1 and Cisco FTD Software Release 7.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If you use IPsec, prevent exploitation by filtering/blocking malicious IP traffic related to decryption errors on the established IPsec connection paths (e.g., apply ACLs/firewall rules to restrict IPsec peer traffic).
- Operational
Monitor for and remediate the unexpected reload/DoS condition on Cisco ASA/FTD devices by validating service availability after any observed reloads caused by exploitation attempts.
Event History
Frequently Asked Questions
What is the vulnerability ID for this Cisco ASA and FTD vulnerability?
The vulnerability ID for this Cisco ASA and FTD vulnerability is CVE-2021-1422.
What is the severity of CVE-2021-1422?
The severity of CVE-2021-1422 is 7.7 (High).
How does the vulnerability in the software cryptography module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software impact the system?
The vulnerability allows an authenticated, remote attacker or an unauthenticated attacker in a man-in-the-middle position to cause an unexpected reload of the system.
Which versions of Cisco Adaptive Security Appliance Software are affected by CVE-2021-1422?
Cisco Adaptive Security Appliance Software version 9.16.1 is affected by CVE-2021-1422.
Which versions of Cisco Firepower Threat Defense are affected by CVE-2021-1422?
Cisco Firepower Threat Defense version 7.0.0.0 is affected by CVE-2021-1422.