CVE-2026-20248: Cisco ASA/FTD DNS DoS Vulnerability

CVE-2026-20248 Overview

CVE-2026-20248 is a denial of service (DoS) vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can send a crafted DNS reply that forces the TCP DNS response handler to restart, reloading the affected device. The flaw is categorized under [CWE-195] Signed to Unsigned Conversion Error and stems from incorrect buffer size tracking during DNS query parsing. Exploitation requires the attacker to answer DNS queries originating from the device, either by controlling the DNS server or by intercepting traffic via a machine-in-the-middle position.

Critical Impact
A successful exploit reloads the firewall, disrupting network traffic protection and creating a sustained DoS condition against Cisco ASA and FTD deployments.

Affected Products

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
Cisco Secure Firewall Threat Defense (FTD) Software
Refer to the Cisco advisory for the complete list of affected releases

Discovery Timeline

2026-09-16 - CVE-2026-20248 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-20248

Vulnerability Analysis

The vulnerability resides in the DNS over TCP response handler within Cisco ASA and FTD software. When the device issues a DNS query and receives a reply, the parser tracks the size of the incoming buffer to bound subsequent processing. A logic error in this size-tracking code allows an attacker-controlled response to trigger an unexpected restart of the response handler process.

The restart cascades into a full device reload, interrupting all traffic transiting the firewall. Because ASA and FTD frequently sit at the network perimeter, an induced reload removes stateful inspection, VPN termination, and access control enforcement for the duration of the outage. Repeated exploitation can produce a sustained outage.

Root Cause

The root cause is a signed to unsigned conversion error [CWE-195] in the DNS query parsing routine. The parser miscalculates or misinterprets the size of the incoming DNS buffer, allowing crafted reply data to violate the expected bounds. The mishandled size value drives control flow into an unrecoverable state, causing the DNS response handler to abort and the device to reload.

Attack Vector

The attack vector is network based and requires no authentication or user interaction. However, the attacker must be able to send responses to DNS queries originating from the affected device. Two exploitation positions apply:

The attacker controls a DNS server that the device queries, allowing direct reply injection.
The attacker occupies a machine-in-the-middle position on the network path between the device and its configured resolver, allowing interception and forgery of replies.

The crafted reply is delivered over TCP, targeting the DNS over TCP response handler specifically. The elevated attack complexity reflects the requirement to be positioned as a valid responder to device-originated DNS queries.

No verified exploit code examples are available. Refer to the Cisco Security Advisory for technical details.

Detection Methods for CVE-2026-20248

Indicators of Compromise

Unexpected device reloads on ASA or FTD appliances that coincide with outbound DNS traffic over TCP.
Crash or traceback logs from the DNS response handler process on the affected device.
Anomalous DNS reply packets over TCP directed at the device's resolver source port.

Detection Strategies

Monitor syslog and crashinfo output from ASA and FTD for repeated process restarts linked to DNS handling.
Inspect DNS over TCP traffic to and from the firewall for malformed or unusually large responses that deviate from RFC 1035 message structure.
Correlate DNS resolver telemetry with firewall availability events to identify a common attacker-controlled resolver.

Monitoring Recommendations

Alert on SNMP coldStart or warmStart traps from ASA and FTD devices, especially outside maintenance windows.
Track DNS resolver reachability and integrity, and log all configured resolvers used by the firewall management plane.
Baseline the volume and size of DNS over TCP responses received by the device and alert on statistical outliers.

How to Mitigate CVE-2026-20248

Immediate Actions Required

Apply the fixed software releases identified in the Cisco Security Advisory.
Restrict device DNS resolution to trusted, internal resolvers reachable only over protected network segments.
Enforce cryptographic protection or authenticated paths between the firewall and its DNS resolvers where feasible.

Patch Information

Cisco has released fixed software for Cisco Secure Firewall ASA and FTD. Consult the vendor advisory cisco-sa-asaftd-tcpdns-dos-p6dUnjr5 for the specific fixed releases mapped to each affected train and follow standard Cisco upgrade procedures.

Workarounds

Configure the device to use DNS resolvers on trusted, isolated management networks to reduce exposure to machine-in-the-middle interception.
Limit the features that generate outbound DNS queries from the device where operational requirements allow.
Apply access control lists on transit paths to restrict which hosts can send DNS responses to the firewall's source addresses.

bash

# Example: restrict device DNS to an internal resolver on a management VRF
dns domain-lookup management
dns server-group DefaultDNS
 name-server 10.10.10.53