Cisco Secure Firewall Threat Defense Software TLS 1.3 DoS (cisco-sa-ftd-tls1-3-dos-dLxwFWgF)

#TRUSTED 377d5635ffa4a53c30854a8803854c10ca30f95753e0b25cdd07225b62c5db23b6b2f07dffc76400e570e2905ffdaaa86f69f2628ed8c145507cadd764db2a2569af764d9c6d7868907146cebdec8e28501415141ca0ab018da95c328d0fbb7325e28360fdcdf0da2ee9220caf7b2e736da82a87513d30b32eeed969cfd3c871fb9c4c572064ccf6f57fe4a8883711078985e56509d2c3275e563d544c36a757d6f32b7aeb17d2d7651f6cc74397cfcf35668e1fb4493b2167ccdbe20cfd028dbf915df943a6930cd0ebce545d34e4d62f3c79a31c0e754f315fd976bc412c97a5160518a32f45b8b80daef50ba1045a2d788a82e12777043b6c8caf215125c3a34830c5fabc27a73cbb4673062d4ff97bf88550833c3e927870905832f7cb9d499fe0dcfeb6b4c91321a50bb72392dd8b6f47c8d427eb0474e0e2112e45d6e5dfac28eb8161c8bd6e42bb22eefcfb997a6e15e7a83b58e8e4d866c6af0c520ef7ce4ec17b902c15c8f508c3b4ca28cc7ceebf450dbe139c1e98628392a3c07eb49e4a4b12a61442ecb0be9a71523a8e9b60df6e63dd104e4644092dd2ffa1439cea74d07393a1763c7583d0662013631b5f6c92cd785ab6db173320e1bfa905b096e78153f7b5ff077880a7889c411b2f373ba83401d61a2d81694690b91d24ed095c36e1df8cd8ce0be9898502a7c0e694d4ae802a9d25f1e144d1271f6c8d
#TRUST-RSA-SHA256 5c0c441fef3920d3770fc81da8aefc7ca75545a92f67dd13f4668f246c8d6c8e819c813be00374796858335ad4bb308633755e22eb61a2cafc90f3e22ed64414e6e2cc59bbf9f84ee1aad4fb128f7ac7855c239cb949eb25415c244cd903569cc12bda99bba5c3f1d43023ffb36e98191f9d89c88347572950ce8de44092783ac8bfd06c06613370bbb1710a926bf9a652b4f2208fce3d64c92fbdba6d698600e2b3f099d2f8b8ca708f41ec719ad71df6c4352e48b1f5a3bdc2b2c6b1027ddc5b8ad6547cea9b838f6b129b1ea0f420d1a15f9cce9e66fbefa7745e4591d553d35d338ed8deb3133428821b5d04b8ce02c0bb270f7be44d1aee6df23efe9d72edb2bcae496bff873d77d941e044730099b0c6989d5ce0eaf5be447dd018f5490ed3d53c086e5b96ced48f1f960ccd95c409c9b51f997d0fc69cd859edf4e2ab436fec6610e9e2f4342355dc047879502a8a129681823d3a380979a2be31a950e454d3d0c44b5a7b78eba9096e11e6e952c12831eeb395e4de0ede9fa09aed2cc563c1641b95cade4fffd4dba1482dbb0bee60569cc0421f15c32d17e3d98419593f506297cc930760257a28e85fcfb6df02aefeff847292102d8c1a85096e94ec774ecaec7dd875f361f1fe354ff149574d8a39262c5b524ac50d48829ae7e9e7e117294ed23dac99922e3ab3784f8b4b48f3af5b88abf62425c1d5a412ed4a
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(348174);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/21");

  script_cve_id("CVE-2026-20135");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwo83926");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ftd-tls1-3-dos-dLxwFWgF");
  script_xref(name:"IAVA", value:"2026-A-1027");

  script_name(english:"Cisco Secure Firewall Threat Defense Software TLS 1.3 DoS (cisco-sa-ftd-tls1-3-dos-dLxwFWgF)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Secure Firewall Threat Defense (FTD) Software is affected by a
denial of service vulnerability. A flaw exists within the TLS 1.3 implementation due to improper buffer management. An
unauthenticated, remote attacker can exploit this issue, via a crafted TLS 1.3 packet, to cause the system to stop
responding.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-tls1.3-dos-dLxwFWgF
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2c8cc221");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwo83926");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwo83926");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20135");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(415);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:firepower_threat_defense");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_enumerate_firepower.nbin");
  script_require_keys("installed_sw/Cisco Firepower Threat Defense");

  exit(0);
}

include('ccf.inc');
include('cisco_workarounds.inc');

var product_info = cisco::get_product_info(name:'Cisco Firepower Threat Defense');

var version_list=make_list(
  '7.0.0',
  '7.0.0.1',
  '7.0.1',
  '7.0.1.1',
  '7.0.2',
  '7.0.2.1',
  '7.0.3',
  '7.0.4',
  '7.0.5',
  '7.0.6',
  '7.0.6.1',
  '7.0.6.2',
  '7.0.6.3',
  '7.0.7',
  '7.0.8',
  '7.0.8.1',
  '7.0.9',
  '7.2.0',
  '7.2.0.1',
  '7.2.1',
  '7.2.2',
  '7.2.3',
  '7.2.4',
  '7.2.4.1',
  '7.2.5',
  '7.2.5.1',
  '7.2.6',
  '7.2.7',
  '7.2.5.2',
  '7.2.8',
  '7.2.8.1',
  '7.2.9',
  '7.2.10',
  '7.2.10.2',
  '7.2.11',
  '7.3.0',
  '7.3.1',
  '7.3.1.1',
  '7.3.1.2',
  '7.4.0',
  '7.4.1',
  '7.4.1.1',
  '7.4.2',
  '7.4.2.1',
  '7.4.2.2',
  '7.4.2.3',
  '7.4.2.4',
  '7.4.3',
  '7.4.4',
  '7.6.0',
  '7.6.1',
  '7.6.2',
  '7.6.2.1',
  '7.6.4',
  '7.7.0',
  '7.7.10',
  '7.7.10.1',
  '7.7.11'
);

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = [
  WORKAROUND_CONFIG['asa_ssl_tls'],
  WORKAROUND_CONFIG['ftd_tls_1.3'],
  {'require_all_generic_workarounds': TRUE}
];

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_HOLE,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwo83926',
  'cmds'          , make_list('show asp table socket', 'show running-config')
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);