Security Brief: Cisco ASA and Firepower CVE-2018-0231 TLS Denial-of-Service Vulnerability
https://vulnify.app/blog/security-brief-cisco-asa-firepower-cve-2018-0231-tls-dos

CVE-2018-0231 is a high-severity TLS vulnerability affecting certain Cisco ASA and Firepower Threat Defense deployments. An unauthenticated remote attacker can send malicious TLS traffic that crashes an affected appliance and causes a denial of service.

What happened CVE-2018-0231 is a high-severity denial-of-service vulnerability in the Transport Layer Security (TLS) library used by certain Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software deployments. Cisco originally disclosed the vulnerability on April 18, 2018. Although the NVD record received additional updates in 2026, this should not be interpreted as a newly discovered 2026 vulnerability. The flaw is caused by insufficient validation of user-controlled input. An unauthenticated remote attacker can send a specially crafted TLS message to an affected interface where SSL services are enabled. Successful exploitation can cause a buffer underflow, crash the affected device, and force it to reload, resulting in a temporary denial-of-service condition. Cisco assigns CVE-2018-0231 a CVSS 3.0 base score of 8.6, rated High. The CVSS vector indicates a network-reachable attack with low attack complexity, no privileges required, and no user interaction required. The assessed impact is to availability rather than confidentiality or integrity. ([NVD][1]) One important technical detail is that SSLv2 and SSLv3 messages cannot be used to exploit this specific flaw. The vulnerability concerns malformed TLS traffic processed by affected SSL-enabled services, rather than simply the presence of an obsolete protocol version. ([Cisco][2]) Affected products and services Cisco's advisory identifies affected ASA and FTD software running on the Adaptive Security Virtual Appliance (ASAv), Firepower Threat Defense Virtual (FTDv), and Firepower 2100 Series Security Appliance. For ASA Software, Cisco states that release 9.2 and later can be vulnerable when affected SSL-enabled features are configured. Relevant features listed by Cisco include Adaptive Security Device Manager (ASDM), AnyConnect SSL VPN, Cisco Security Manager connectivity, Clientless SSL VPN, Mobile User Security, and SAML single sign-on. ([Cisco][2]) For FTD, Cisco identified vulnerable releases in the 6.0, 6.0.1, 6.1.0, 6.2.1, and 6.2.2 branches before their respective fixed releases. Exposure depends on configuration. Cisco specifically identifies the HTTP service and, on supported releases, AnyConnect SSL VPN as affected features. This means simply owning a Cisco appliance is not enough to establish exposure. Administrators need to confirm the product, software release, and whether a vulnerable SSL service is enabled on an interface reachable by a potential attacker. ([Cisco][2]) Why it matters for website owners CVE-2018-0231 is not a vulnerability in website application code. Its relevance to website operators comes from where ASA and FTD appliances are commonly deployed. Firewalls, VPN gateways, virtual security appliances, and related perimeter systems can sit directly in front of public websites, APIs, administrative portals, or remote-access infrastructure. If an internet-facing appliance is vulnerable, an attacker does not need valid credentials to attempt exploitation. A successful attack can reload the device and interrupt connectivity through it. Depending on the network design, that interruption can affect websites, VPN access, management services, APIs, or other systems relying on the appliance for traffic handling. The vulnerability therefore creates an availability risk even though the underlying web application may contain no related software flaw. Cisco's published CVSS vector records no direct confidentiality or integrity impact for this issue. The primary concern is service availability. That distinction is useful when prioritizing remediation: CVE-2018-0231 is not described by Cisco as a route to data theft or remote code execution, but an exposed vulnerable appliance can still become a single point of failure for services behind it. ([NVD][1]) Exploitation and remediation Cisco states that its Product Security Incident Response Team was not aware of public announcements or malicious use of CVE-2018-0231 when the advisory was published. The current NVD record also contains a CISA SSVC assessment indicating no known exploitation. That does not remove the need to patch, particularly where an affected SSL service remains exposed to untrusted networks. ([NVD][3]) Cisco released software updates to address the vulnerability and explicitly states that there are no workarounds that fully resolve it. Historical first-fixed releases included ASA 9.2.4.27, 9.4.4.13, 9.6.3.20, 9.7.1.16, and 9.8.2.14 for the corresponding branches. For FTD, Cisco's original guidance included migration or updates to fixed releases such as 6.1.0.6 and 6.2.2.1, depending on the affected branch. ([Cisco][2]) Those version numbers are useful for understanding the original remediation boundary, but organizations should not treat an old first-fixed release as a current upgrade target. These product branches are years old. Administrators maintaining legacy Cisco equipment should review Cisco's current lifecycle and support information and move to a presently supported software release and hardware platform where required. What to check on your site Identify whether ASAv, FTDv, or Firepower 2100 appliances are protecting internet-facing websites, APIs, VPN services, or administrative systems. Use the Cisco CLI show version command, or the relevant management interface, to identify the software release actually running on each appliance. Cisco specifically documents show version as a method for checking ASA and FTD software versions. ([Cisco][2]) Review whether affected services such as ASDM HTTP access, AnyConnect SSL VPN, Clientless SSL VPN, SAML SSO, or FTD HTTP services are enabled. Check which interfaces expose those services and whether access is unnecessarily available from untrusted networks. Compare the deployed software against Cisco's advisory and current support guidance, then upgrade where required. Cisco does not provide a complete workaround for the vulnerability. Use Vulnify's Checker to review the externally visible TLS configuration of public services. Use Deep Analysis to examine additional public-facing TLS characteristics and identify configuration issues that deserve follow-up. External TLS assessment can help identify exposed services and weaknesses visible from the public internet, but it should not be used as proof that CVE-2018-0231 is present or absent. Confirming this Cisco vulnerability requires checking the actual appliance model, software version, enabled features, and vendor remediation status. Vulnify can support public-surface assessment, while patch verification and appliance configuration review remain administrator responsibilities. Reducing exposure beyond patching Applying a supported Cisco software release is the primary remediation, but organizations should also review why individual management and remote-access services are internet-accessible. Administrative interfaces should be restricted to trusted management networks or approved source addresses wherever operationally possible. VPN and public-facing services that must remain exposed should be inventoried so administrators know which appliances form part of the organization's external attack surface. This is particularly important for older security appliances. A device may have been deployed years ago and remain operational long after the application or infrastructure it originally supported has changed. Periodic external assessment can help identify forgotten TLS endpoints, management interfaces, and legacy services that remain reachable even when they are no longer required. Related reading For a broader explanation of protocol versions, certificates, cipher configuration, and common deployment mistakes, see Vulnify's Configuration Basics . Website teams can also use the Analyzer to review HTTP response headers that complement transport-layer protections. Sources National Vulnerability Database: CVE-2018-0231 Security Advisory: Adaptive Security Appliance TLS Denial of Service Vulnerability