{"id":5232,"date":"2026-08-12T15:48:17","date_gmt":"2026-08-12T20:48:17","guid":{"rendered":"https:\/\/cert.pa\/?p=5232"},"modified":"2026-08-12T15:49:55","modified_gmt":"2026-08-12T20:49:55","slug":"vulnerabilidad-de-denegacion-de-servicio-en-cisco-secure-firewall-asa-y-ftd","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=5232","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2026-ago-12: Vulnerabilidad de Denegaci\u00f3n de Servicio en Cisco Secure Firewall ASA y FTD"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>CVE:<\/strong> CVE-2026-20349<br><strong>Severidad:<\/strong> Alta<br><strong>CVSS:<\/strong> 8.6<br><strong>Tipo:<\/strong> Denegaci\u00f3n de Servicio (DoS)<br><strong>Estado: <\/strong>Explotaci\u00f3n activa de CVE-2026-20349 reportada<\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Resumen<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cisco public\u00f3 el 11 de agosto de 2026 una actualizaci\u00f3n de seguridad para corregir la vulnerabilidad <strong>CVE-2026-20349<\/strong>, que afecta a <strong>Cisco Secure Firewall Adaptive Security Appliance (ASA)<\/strong> y <strong>Cisco Secure Firewall Threat Defense (FTD)<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La vulnerabilidad se encuentra en el procesamiento de solicitudes HTTP del servicio <strong>Remote Access SSL VPN<\/strong> y se debe a una validaci\u00f3n insuficiente de errores.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Un atacante remoto y no autenticado puede enviar una solicitud HTTP especialmente dise\u00f1ada al servicio Remote Access SSL VPN y provocar que el dispositivo afectado se <strong>recargue inesperadamente<\/strong>, generando una condici\u00f3n de <strong>denegaci\u00f3n de servicio (DoS)<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cisco inform\u00f3 que su <strong>Product Security Incident Response Team (PSIRT)<\/strong> tuvo conocimiento de <strong>explotaci\u00f3n activa de esta vulnerabilidad en agosto de 2026<\/strong>.<\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Productos afectados<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La vulnerabilidad puede afectar a dispositivos <strong>Cisco Secure Firewall ASA y FTD<\/strong> que ejecuten una versi\u00f3n vulnerable del software y tengan habilitada una o m\u00e1s de las configuraciones indicadas por Cisco como potencialmente vulnerables.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Las configuraciones son:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>IKEv2 Remote Access VPN con servicios de cliente<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">          crypto ikev2 enable &lt;interface_name> client-services port &lt;port_numbers><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>SSL VPN<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">          webvpn<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">          enable &lt;interface_name><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Zero Trust Network Access (ZTNA)<\/strong> \u2014 disponible \u00fanicamente en Cisco Secure FTD<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">          zero-trust<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">          enable<\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Producto no afectado<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cisco confirm\u00f3 que <strong>Cisco Secure Firewall Management Center (FMC)<\/strong> no est\u00e1 afectado por esta vulnerabilidad.<\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Impacto<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La explotaci\u00f3n exitosa puede provocar el <strong>reinicio inesperado del dispositivo<\/strong>, resultando en una condici\u00f3n de <strong>denegaci\u00f3n de servicio (DoS)<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">El vector CVSS publicado por Cisco es:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:N\/I:N\/A:H<\/strong><\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Recomendaciones<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cisco indica que no existen workarounds que solucionen esta vulnerabilidad.<\/strong> La compa\u00f1\u00eda recomienda actualizar a una versi\u00f3n de software corregida para remediarla completamente.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Versiones corregidas<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cisco ha publicado hotfixes para las ramas de software afectadas.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cisco Secure Firewall ASA:<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th><strong>Versi\u00f3n<\/strong><\/th><th><strong>Hotfix<\/strong><\/th><\/tr><\/thead><tbody><tr><td>9.16<\/td><td>89.16.4.50<\/td><\/tr><tr><td>9.18<\/td><td>89.18.4.50<\/td><\/tr><tr><td>9.20<\/td><td>9.20.4.235<\/td><\/tr><tr><td>9.22<\/td><td>9.22.3.191<\/td><\/tr><tr><td>9.23<\/td><td>9.23.1.211<\/td><\/tr><tr><td>9.24<\/td><td>9.24.1.221<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cisco Secure FTD:<\/strong> se han publicado hotfixes para las ramas <strong>7.0, 7.2, 7.4, 7.6, 7.7 y 10.0<\/strong>. El hotfix exacto depende de la versi\u00f3n y plataforma del dispositivo.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cisco recomienda utilizar <strong>Cisco Software Checker<\/strong> para determinar si una versi\u00f3n espec\u00edfica est\u00e1 afectada y cu\u00e1l es la primera versi\u00f3n que corrige la vulnerabilidad.<\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Conclusi\u00f3n<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CVE-2026-20349 debe tratarse como una vulnerabilidad de alta prioridad<\/strong> en entornos que utilicen Cisco Secure Firewall ASA o FTD.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La vulnerabilidad tiene un <strong>CVSS de 8.6<\/strong>, puede ser explotada de forma remota y sin autenticaci\u00f3n, y Cisco ha confirmado <strong>explotaci\u00f3n activa<\/strong>. Debido a que <strong>no existe un workaround<\/strong> y Cisco ya ha publicado actualizaciones de seguridad, se recomienda realizar la <strong>remediaci\u00f3n con car\u00e1cter urgente<\/strong>.<\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Referencias<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cisco Security Advisory \u2014 CVE-2026-20349: <a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-asaftd-vpn-dos-dzv4mQFF\" target=\"_blank\" rel=\"noreferrer noopener\">Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote\u2026<\/a><\/li>\n\n\n\n<li>SecurityWeek \u2014 Cisco Patches Firewall Zero-Day Exploited for DoS Attacks: <a href=\"https:\/\/www.securityweek.com\/cisco-patches-firewall-zero-day-exploited-for-dos-attacks\/\">https:\/\/www.securityweek.com\/cisco-patches-firewall-zero-day-exploited-for-dos-attacks\/<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Informaci\u00f3n de contacto<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CSIRT Panam\u00e1<\/strong>\u00a0\u00b7 Computer Security Incident Response Team<br>Autoridad Nacional para la Innovaci\u00f3n Gubernamental<br>E-Mail: incidentes@cert.pa \u00b7\u00a0<a href=\"mailto:info@cert.pa\">info@cert.pa<\/a><br>Phone: +507 520-CERT (2378) \u00b7 Web:\u00a0<a href=\"https:\/\/cert.pa\/\">https:\/\/cert.pa<\/a>\u00a0\u00b7 X: CSIRTPanama \u00b7 Key ID: 16F2B124<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE: CVE-2026-20349Severidad: AltaCVSS: 8.6Tipo: Denegaci\u00f3n de Servicio (DoS)Estado: Explotaci\u00f3n activa de CVE-2026-20349 reportada Resumen Cisco public\u00f3 el 11 de agosto de 2026 una actualizaci\u00f3n de seguridad para corregir la vulnerabilidad CVE-2026-20349, que afecta a Cisco&#8230;<\/p>\n","protected":false},"author":4,"featured_media":5235,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[72,246,68],"class_list":["post-5232","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad","tag-avisos-de-seguridad","tag-critico","tag-vulnerabilidades"],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/5232","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5232"}],"version-history":[{"count":5,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/5232\/revisions"}],"predecessor-version":[{"id":5239,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/5232\/revisions\/5239"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/5235"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}