Cisco ASA/FTD SSL VPN Zero-Day Under Active Exploitation: Detecting and Defending Against Remote Firewall Crashes

---
title: Cisco ASA/FTD Unexpected Reload or Watchdog Crash
description: Detects syslog severity-1 crash, watchdog, traceback, or reload events on Cisco ASA/FTD devices, which may indicate exploitation of the SSL VPN denial-of-service zero-day.
references:
  - https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/
  - https://sec.cloudapps.cisco.com/security/center/publicationListing.x
author: Security Arsenal
date: 2026/01/15
logsource:
  product: cisco
  service: asa
detection:
  selection:
    cisco_message_id:
      - 'ASA-1-104001'
      - 'ASA-1-104002'
      - 'ASA-1-199011'
      - 'FTD-1-199011'
  selection_keywords:
    Message|contains:
      - 'watchdog'
      - 'Traceback'
      - 'crashinfo'
      - 'System reload'
      - 'Reload requested'
  condition: selection or selection_keywords
falsepositives:
  - Planned maintenance reloads
  - Power events
level: high
---
title: Cisco ASA/FTD VPN Portal Connection Burst Preceding Outage
description: Detects abnormal bursts of inbound connections to the ASA/FTD SSL VPN service (TCP/443) from single external sources, a pattern consistent with zero-day trigger attempts against the VPN web server.
references:
  - https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/
author: Security Arsenal
date: 2026/01/15
logsource:
  product: cisco
  service: asa
detection:
  selection:
    cisco_message_id:
      - 'ASA-6-302013'
      - 'ASA-6-302015'
    DestinationPort: 443
  filter_known_vpn_users:
    SourceIp|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
      - '172.16.0.0/12'
  condition: selection and not filter_known_vpn_users
timeframe: 60s
falsepositives:
  - Legitimate remote worker login storms after outages
  - Vulnerability scanners (allowlist scanner ranges)
level: medium
---
title: Cisco ASA/FTD Failover Pair Near-Simultaneous Failure
description: Detects failover state changes and mate reload events indicating both HA units crashed within a short window, a strong indicator of scripted external triggering rather than hardware fault.
references:
  - https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/
author: Security Arsenal
date: 2026/01/15
logsource:
  product: cisco
  service: asa
detection:
  selection:
    cisco_message_id:
      - 'ASA-1-103001'
      - 'ASA-1-103002'
      - 'ASA-1-103004'
      - 'ASA-1-103005'
      - 'ASA-1-104001'
      - 'ASA-1-104002'
      - 'ASA-1-104003'
      - 'ASA-1-104004'
  condition: selection
falsepositives:
  - Failover testing during change windows
level: critical

// Hunt: Cisco ASA/FTD crash, reload, and failover events correlated with VPN portal traffic
// Requires ASA/FTD syslog ingestion via CEF/Syslog into Sentinel
let CrashEvents = CommonSecurityLog
| where DeviceVendor =~ "Cisco"
| where DeviceProduct has_any ("ASA", "FTD", "Firepower")
| where LogSeverity in ("1", "Alert") or Message has_any ("watchdog", "Traceback", "crashinfo", "System reload", "Reload requested", "failover")
| project TimeGenerated, DeviceName, SourceIP, Message, LogSeverity;
let VpnBurst = CommonSecurityLog
| where DeviceVendor =~ "Cisco"
| where DestinationPort == 443
| where Message has_any ("302013", "302015")
| summarize ConnectionCount = count(), DistinctDestinations = dcount(DestinationIP) by SourceIP, bin(TimeGenerated, 1m)
| where ConnectionCount > 200;
CrashEvents
| join kind=leftouter (VpnBurst) on $left.TimeGenerated >= $right.TimeGenerated and $left.TimeGenerated <= $right.TimeGenerated + 5m
| project CrashTime = TimeGenerated, DeviceName, Message, TriggerSourceIP = SourceIP1, PreCrashConnections = ConnectionCount
| order by CrashTime desc;

-- Hunt a syslog collector for ASA/FTD crash and reload artifacts
-- Targets log files on a central syslog/rsyslog host receiving firewall telemetry
LET logs = SELECT FullPath FROM glob(globs='/var/log/**/*asa*.log')
UNION SELECT FullPath FROM glob(globs='/var/log/**/*ftd*.log')
UNION SELECT FullPath FROM glob(globs='/var/log/syslog*')

SELECT FullPath, Line, timestamp(string=Timestamp) AS EventTime
FROM foreach(row=logs,
query={
  SELECT FullPath, Line,
         parse_string_with_regex(string=Line,
           regex='^(?P<Timestamp>\w+\s+\d+\s+[\d:]+)').Timestamp AS Timestamp
  FROM parse_lines(filename=FullPath)
  WHERE Line =~ '(?i)(watchdog|traceback|crashinfo|system reload|reload requested|ASA-1-10400|FTD-1-199011)'
})
ORDER BY EventTime DESC

#!/usr/bin/env bash
# asa-ftd-dos-triage.sh — triage and compensating-control checks for ASA/FTD SSL VPN DoS zero-day
# Run from a jump host with SSH access to the appliance and reachability to the VPN portal.

FW_HOST="$1"          # e.g. asa-edge-01.example.com
SSH_USER="$2"         # read-only ops account

if [ -z "$FW_HOST" ] || [ -z "$SSH_USER" ]; then
  echo "Usage: $0 <firewall-host> <ssh-user>"; exit 1
fi

run() { ssh -o BatchMode=yes -o ConnectTimeout=10 "${SSH_USER}@${FW_HOST}" "$1"; }

echo "=== [1/5] Software version (compare against Cisco fixed releases in the advisory) ==="
run "show version | include Cisco Adaptive|Firepower|Software Version"

echo "=== [2/5] SSL VPN exposure check — webvpn must be assessed if enabled ==="
run "show running-config webvpn | include enable"

echo "=== [3/5] Crash history — unexpected crashinfo = investigate immediately ==="
run "show crashinfo | include Crash|Traceback|Date"
run "show reload | include Reload"

echo "=== [4/5] Connection burst check on VPN portal (TCP/443) ==="
run "show conn address 0.0.0.0 port 443 | count"

echo "=== [5/5] Syslog reachability — confirm crash events are being shipped off-box ==="
run "show running-config logging | include host"

echo ""
echo "INTERIM HARDENING (evaluate before applying — confirm against Cisco advisory):"
echo "  1. If business-tolerable: 'no webvpn enable <outside-if>' to remove exposure until patched"
echo "  2. Restrict portal reachability: control-plane ACL permitting only known egress ranges"
echo "  3. Rate-limit TCP/443 at upstream edge (ISP scrubbing, cloud WAF in front if architecture allows)"
echo "  4. Ensure syslog severity 1 events alert the SOC on-call channel, not just dashboards"