CVE-2021-40118

HIGH

Cisco ASA & FTD Unauthenticated DoS via HTTPS Request Parsing

Title source: llm
STIX 2.1

Description

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious HTTPS request to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

References (1)

Core 1

Scores

CVSS v3 8.6
EPSS 0.0026
EPSS Percentile 49.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-121 CWE-787
Status published
Products (43)
cisco/adaptive_security_appliance < 9.8.4.40
cisco/adaptive_security_appliance_software 9.9.0 - 9.12.4.29
cisco/asa_5505_firmware 009.012\(004.024\)
cisco/asa_5505_firmware 009.015\(001\)
cisco/asa_5505_firmware 009.015\(001.015\)
cisco/asa_5505_firmware 009.015\(001.016\)
cisco/asa_5505_firmware 009.016\(001\)
cisco/asa_5512-x_firmware 009.012\(004.024\)
cisco/asa_5512-x_firmware 009.015\(001\)
cisco/asa_5512-x_firmware 009.015\(001.015\)
... and 33 more
Published Oct 27, 2021
Tracked Since Feb 18, 2026