Cisco Adaptive Security Appliance (ASA) Remote Access SSL VPN DoS (cisco-sa-asaftd-vpn-dos-dzv4mQFF)

#TRUSTED 4d3eaaab646bb6e17f34868c0e47bbca6a70a9b7eee52d30a7f6554c68b6989da122c7139ac9d9f1f8125ab24d70900946d50d92ab986778b018175b61db0808ef05392246962b411322fd3c848e3fec789fe12ca20adf115b30c0e5f141877ee9e2015078ba7fe143e51c0adc5c0e5d18f0c1c60c25ed5716db5c7fa48eb3840c38735dd84111b0e8a7df84ab7acbbcf2d041f8f8955e75846e3e17f28c89037b5cea0d499502ab704169783af2fa493c26b114d6cdf7ec73d5817c548e4acc310d7981ac3a15460c904d5a70c00e401ec45016cbd4047e7e2e397cdf9e2665e9a7cc1daa3cb3719d51383e0bd2f3950621de96f2331ea932ea32ad267bfdee9117e1a65d154af66049db3ed7318174313481e7d8ca2f20d964ad604db29134eaa11d673a188c714e9c1d4909cd16ce8adfd2d6f8b929d87c53d35ac8548b304786644bd8368f8116c9d9f88cbf888aa9c312e248d6b51f8ceeaf7ea0079ae492d4a2a33e5b07048ef7bcb1d986499086497c97a763c7331a7d84054f2cb237a11af00ccba0833c1684b4e3a74397e21f6f5e981d92ecb53ccb9ec520d7541fa967262ad994647d5360d1c38e1f257eb505f92de26225bf13e7ae802754a133eafdab50080cae761a59349b871bf4a8c5df162c693b583fd3e73cd92554add184d47ccc2112caea83234a13e761f73b45965e4ccdc45d3fc17a33ccfe7c4757
#TRUST-RSA-SHA256 b13186efd03cd4ae211f55c93db67b42cea144fad39bee202ea0d409832062cfc9816de91a066debf9833514abb68deb4b640e3efd886ba7b3ae8119e5c303d852c77232c3fda7ed908a38df5428d9709322c5c0c279bc9389e7fdcd08d53c92bcfa271f2ea4c762c1ecf01f2a97598a58c719e51c66ad9b879b2095374e97af07c8dcd58ae0c863e119c42beb35c96ff467bd5365fb76e02d078875f199a342b5b0d5eae6a0b9a8e92998f6878157a7f5eb63004f7f781c8615170acc3bdf2406e29e8215c631f409488f563109489156345d9e6ab3458e8b3c4c111733526519d7da8d8166e4d4fea3569e361ac8f5f80d0a78899865aae2cce4c8071b51ce1afe19952a0d74af6bc63f0c8ece56eb3f9c277563962909c8c32c026b83d27c254666e94b6ee8e61c5a59a02b99b26183b476df0f039a6e39f2ba68f04eadb65fb462d93919e082078ad9b2613ef69e8dd507159dc51bd9b10787541f6153b43443f02c3a42271ef507a3eac9ecc3ae543360efed4bcd9717c705ace11d03c55478be225f71fb2765c2b6a21622bd51c6c652eeb52eba84fdcf6f9d041ff72fa2e9b5494d83c615ce7c4d687d2ae2f39be63c0e6bec0e02a79a5ce00075748052d20c5223c0dcb3e57db7a5c058b370e3ed917914ed17965f6e16a78d9cfca13d1297b64687a9f9211a63b20014318c74975a3c5164a4ed45e26f056aafab9b
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(335417);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/15");

  script_cve_id("CVE-2026-20349");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwv96220");
  script_xref(name:"CISCO-SA", value:"cisco-sa-asaftd-vpn-dos-dzv4mQFF");
  script_xref(name:"IAVA", value:"2026-A-0850");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/08/14");

  script_name(english:"Cisco Adaptive Security Appliance (ASA) Remote Access SSL VPN DoS (cisco-sa-asaftd-vpn-dos-dzv4mQFF)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the Cisco ASA software is affected by a denial of service vulnerability. A flaw
exists due to insufficient error checking when processing HTTP requests. An unauthenticated, remote attacker can exploit
this issue, via a crafted HTTP request to the Remote Access SSL VPN service, to cause the system to stop responding.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4fa90043");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwv96220");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwv96220");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20349");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(244);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/14");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:adaptive_security_appliance_software");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_asa_detect.nbin");
  script_require_keys("Host/Cisco/ASA", "Settings/ParanoidReport");

  exit(0);
}

include('ccf.inc');
include('cisco_workarounds.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var product_info = cisco::get_product_info(name:'Cisco Adaptive Security Appliance (ASA) Software');

var version_list=make_list(
  '9.16.1',
  '9.16.1.28',
  '9.16.2',
  '9.16.2.3',
  '9.16.2.7',
  '9.16.2.11',
  '9.16.2.13',
  '9.16.2.14',
  '9.16.3',
  '9.16.3.3',
  '9.16.3.14',
  '9.16.3.15',
  '9.16.3.19',
  '9.16.3.23',
  '9.16.4',
  '9.16.4.9',
  '9.16.4.14',
  '9.16.4.18',
  '9.16.4.19',
  '9.16.4.27',
  '9.16.4.38',
  '9.16.4.39',
  '9.16.4.42',
  '9.16.4.48',
  '9.16.4.55',
  '9.16.4.57',
  '9.16.4.61',
  '9.16.4.62',
  '9.16.4.67',
  '9.16.4.70',
  '9.16.4.71',
  '9.16.4.76',
  '9.16.4.82',
  '9.16.4.84',
  '9.16.4.85',
  '9.16.4.89',
  '9.16.4.92',
  '9.18.1',
  '9.18.1.3',
  '9.18.2',
  '9.18.2.5',
  '9.18.2.7',
  '9.18.2.8',
  '9.18.3',
  '9.18.3.39',
  '9.18.3.46',
  '9.18.3.53',
  '9.18.3.55',
  '9.18.3.56',
  '9.18.4',
  '9.18.4.5',
  '9.18.4.8',
  '9.18.4.22',
  '9.18.4.24',
  '9.18.4.29',
  '9.18.4.34',
  '9.18.4.40',
  '9.18.4.47',
  '9.18.4.50',
  '9.18.4.52',
  '9.18.4.53',
  '9.18.4.57',
  '9.18.4.66',
  '9.18.4.67',
  '9.18.4.68',
  '9.18.4.71',
  '9.18.4.76',
  '9.18.4.135',
  '9.18.4.82',
  '9.18.4.90',
  '9.19.1',
  '9.19.1.5',
  '9.19.1.9',
  '9.19.1.12',
  '9.19.1.18',
  '9.19.1.22',
  '9.19.1.24',
  '9.19.1.27',
  '9.19.1.28',
  '9.19.1.31',
  '9.19.1.37',
  '9.19.1.38',
  '9.19.1.42',
  '9.20.1',
  '9.20.1.5',
  '9.20.2',
  '9.20.2.10',
  '9.20.2.21',
  '9.20.2.22',
  '9.20.3',
  '9.20.3.4',
  '9.20.3.7',
  '9.20.3.9',
  '9.20.3.10',
  '9.20.3.13',
  '9.20.3.16',
  '9.20.3.20',
  '9.20.4',
  '9.20.4.7',
  '9.20.4.10',
  '9.20.4.14',
  '9.20.4.19',
  '9.20.4.22',
  '9.20.4.28',
  '9.20.4.30',
  '9.20.4.34',
  '9.20.4.46',
  '9.22.1.1',
  '9.22.1.3',
  '9.22.1.2',
  '9.22.1.6',
  '9.22.2',
  '9.22.2.4',
  '9.22.2.9',
  '9.22.2.13',
  '9.22.2.14',
  '9.22.2.20',
  '9.22.2.32',
  '9.22.3',
  '9.22.3.5',
  '9.23.1',
  '9.23.1.3',
  '9.23.1.7',
  '9.23.1.13',
  '9.23.1.19',
  '9.23.1.22',
  '9.23.1.26',
  '9.23.1.195',
  '9.23.1.32',
  '9.24.1',
  '9.24.1.5',
  '9.24.1.9',
  '9.24.1.155',
  '9.24.1.11'
);

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = [
  WORKAROUND_CONFIG['anyconnect_client_services'],
  WORKAROUND_CONFIG['ssl_vpn']
];

var reporting = make_array(
  'port'    , 0,
  'severity', SECURITY_HOLE,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwv96220',
  'cmds'    , make_list('show running-config')
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);