CVE-2018-0231

Severity: high (CVSS 8.6 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-19 · updated 2026-08-11
Weakness: CWE-20

Description

A vulnerability in the Transport Layer Security (TLS) library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of the affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious TLS message to an interface enabled for Secure Layer Socket (SSL) services on an affected device. Messages using SSL Version 3 (SSLv3) or SSL Version 2 (SSLv2) cannot be be used to exploit this vulnerability. An exploit could allow the attacker to cause a buffer underflow, triggering a crash on an affected device. This vulnerability affects Cisco ASA Software and Cisco FTD Software that is running on the following Cisco products: Adaptive Security Virtual Appliance (ASAv), Firepower Threat Defense Virtual (FTDv), Firepower 2100 Series Security Appliance. Cisco Bug IDs: CSCve18902, CSCve34335, CSCve38446.

Affected products

Cisco ASA Software: 9.8(1), 98.1(1.154)
Cisco Firepower Threat Defense Software: from 6.0 before 6.1.0.6; from 6.2.1 before 6.2.2.1 — fixed in 6.1.0.6, 6.2.2.1

How to fix

Upgrade to a fixed version: Cisco Firepower Threat Defense Software 6.1.0.6, 6.2.2.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-0231 or the next vulnerability affects your stack