CVE-2021-40117: Cisco Adaptive Security Appliance

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

A vulnerability in SSL/TLS message handler for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because incoming SSL/TLS packets are not properly processed. An attacker could exploit this vulnerability by sending a crafted SSL/TLS packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Affected products

Cisco Adaptive Security Appliance: before 9.8.4.40 (fixed in 9.8.4.40)
Cisco Adaptive Security Appliance Software: from 9.9.0, before 9.12.4.26 (fixed in 9.12.4.26); from 9.13.0, before 9.14.3.9 (fixed in 9.14.3.9); from 9.15.0, before 9.15.1.17 (fixed in 9.15.1.17); from 9.16.0, before 9.16.2.3 (fixed in 9.16.2.3)
Cisco ASA 5505 Firmware: version 009.009(002.085) only; version 009.014(002.106) only
Cisco ASA 5512-X Firmware: version 009.009(002.085) only; version 009.014(002.106) only
Cisco ASA 5515-X Firmware: version 009.009(002.085) only; version 009.014(002.106) only
Cisco ASA 5525-X Firmware: version 009.009(002.085) only; version 009.014(002.106) only
Cisco ASA 5545-X Firmware: version 009.009(002.085) only; version 009.014(002.106) only
Cisco ASA 5555-X Firmware: version 009.009(002.085) only; version 009.014(002.106) only
Cisco ASA 5580 Firmware: version 009.009(002.085) only; version 009.014(002.106) only
Cisco ASA 5585-X Firmware: version 009.009(002.085) only; version 009.014(002.106) only
Cisco Secure Firewall Threat Defense: before 6.2.3.17 (fixed in 6.2.3.17); from 6.3.0, before 6.4.0.13 (fixed in 6.4.0.13); from 6.5.0, before 6.6.5 (fixed in 6.6.5); from 6.7.0, before 6.7.0.3 (fixed in 6.7.0.3); from 7.0.0, before 7.0.1 (fixed in 7.0.1)

Published 2021-10-27. Last modified 2026-08-11.