CVE-2026-20248

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Secure Firewall Threat Defense (FTD) Software (affected versions not specified)

Description A logic error in the DNS over TCP implementation occurs when parsing a DNS query and tracking incoming buffer sizes. An unauthenticated remote attacker can exploit this by sending a crafted reply to a DNS query initiated by the device, causing the TCP DNS response handler to restart unexpectedly. This results in a device reload and a denial of service (DoS) condition. The attacker must be able to respond to DNS queries, either by controlling the DNS service or via a machine-in-the-middle attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.