CVE-2021-34792
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to cause a denial of service (DoS) by overwhelming Cisco ASA and FTD devices with excessive connections. The improper resource management causes device reloads, disrupting network security services. Organizations using affected Cisco security appliances are at risk.
💻 Affected Systems
- Cisco Adaptive Security Appliance (ASA) Software
- Cisco Firepower Threat Defense (FTD) Software
📦 What is this software?
Adaptive Security Appliance Software by Cisco
View all CVEs affecting Adaptive Security Appliance Software →
Adaptive Security Appliance Software by Cisco
View all CVEs affecting Adaptive Security Appliance Software →
Adaptive Security Appliance Software by Cisco
View all CVEs affecting Adaptive Security Appliance Software →
Adaptive Security Appliance Software by Cisco
View all CVEs affecting Adaptive Security Appliance Software →
⚠️ Risk & Real-World Impact
Worst Case
Complete network security service disruption as the device reloads, potentially allowing attacks to bypass security controls during the outage.
Likely Case
Intermittent service disruptions and performance degradation during connection floods, requiring manual intervention to restore services.
If Mitigated
Minimal impact with proper rate limiting and network segmentation in place, though device may still experience performance issues.
🎯 Exploit Status
Exploitation requires generating high connection rates, which can be achieved with simple flooding tools. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Multiple fixed versions - refer to Cisco advisory for specific patched releases
Vendor Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-dos-Unk689XY
Restart Required: Yes
Instructions:
1. Check current ASA/FTD version. 2. Download appropriate fixed version from Cisco. 3. Backup configuration. 4. Apply update via ASDM or CLI. 5. Reboot device. 6. Verify update success.
🔧 Temporary Workarounds
Connection Rate Limiting
allImplement connection rate limiting to prevent excessive connections from single sources
class-map match-any CMAP_CONNECTION_LIMIT
match access-list ACL_CONNECTION_LIMIT
policy-map global_policy
class CMAP_CONNECTION_LIMIT
set connection per-client-max 100
set connection per-client-embryonic-max 50
TCP Intercept Configuration
allConfigure TCP intercept to manage connection establishment rates
ip tcp intercept list ACL_TCP_INTERCEPT
ip tcp intercept mode intercept
ip tcp intercept max-incomplete high 500
ip tcp intercept max-incomplete low 400
🧯 If You Can't Patch
- Implement strict connection rate limiting and monitoring
- Deploy network segmentation to limit exposure and contain potential DoS impact
🔍 How to Verify
Check if Vulnerable:
Check ASA/FTD version against affected versions in Cisco advisory: show versionCheck Version:
show versionVerify Fix Applied:
Verify version is updated to patched release: show version | include Version📡 Detection & Monitoring
Log Indicators:
- High connection establishment rates
- Device reload events
- Memory allocation failures
- Resource exhaustion warnings
Network Indicators:
- Sudden spike in connection attempts
- Unusual traffic patterns from single sources
- Service interruption alerts
SIEM Query:
source="cisco_asa" AND ("%ASA-4-106023" OR "%ASA-4-106100" OR "%ASA-6-302013" OR "%ASA-6-302014") | stats count by src_ip