CVE-2026-20022

Analyzed Analyzed - Analysis Complete

OSPF Packet Processing Buffer Overflow in Cisco ASA/FTD Causes DoS

Publication date: 2026-03-04

Last updated on: 2026-08-11

Assigner: Cisco Systems, Inc.

Description

A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition when OSPF canonicalization debug is enabled by using the command debug ip ospf canon. This vulnerability is due to insufficient input validation when processing OSPF LSU packets. An attacker could exploit this vulnerability by sending crafted unauthenticated OSPF packets. A successful exploit could allow the attacker to write to memory outside of the packet data, causing the device to reload, resulting in a DoS condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-04

Last Modified

2026-08-11

Generated

2026-08-15

AI Q&A

2026-03-04

EPSS Evaluated

2026-08-14

NVD

CVE-2026-20022

EUVD

EUVD-2026-9479

Affected Vendors & Products

Vendor	Product	Version / Range
cisco	secure_firewall_threat_defense	7.6.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-823	The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the OSPF protocol implementation of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. It occurs due to insufficient input validation when processing OSPF Link State Update (LSU) packets.

An unauthenticated, adjacent attacker can exploit this by sending specially crafted OSPF packets when the OSPF canonicalization debug feature is enabled using the command debug ip ospf canon.

Successful exploitation allows the attacker to write to memory outside the intended packet data, causing the affected device to reload unexpectedly and resulting in a denial-of-service (DoS) condition.

Detection Guidance

This vulnerability occurs when OSPF canonicalization debug is enabled using the command debug ip ospf canon. Detection involves checking if this debug command is active on the affected Cisco Secure Firewall ASA or Cisco Secure FTD devices.

To detect if the vulnerability might be exploited or if the device is vulnerable, verify whether the debug ip ospf canon command is enabled and monitor for unexpected device reloads or crashes.

Suggested command to check if the debug is enabled: show debugging

If debug ip ospf canon is listed as enabled, the device is at risk if exposed to crafted unauthenticated OSPF packets.

Impact Analysis

This vulnerability can cause affected Cisco firewall devices to reload unexpectedly, leading to a denial-of-service (DoS) condition.

Such unexpected reloads can disrupt network security operations, potentially causing downtime and loss of network protection.

Because the attack requires adjacency and the debug feature to be enabled, the risk is somewhat limited but still significant in environments where these conditions are met.

Compliance Impact

I don't know

Mitigation Strategies

The immediate mitigation step is to disable the OSPF canonicalization debug feature by turning off the debug ip ospf canon command on affected devices.

Additionally, restrict access to the device to prevent unauthenticated adjacent attackers from sending crafted OSPF packets.

Monitoring and limiting OSPF traffic from untrusted sources can also reduce the risk of exploitation.

Hi! I’m here to help you understand CVE-2026-20022. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70