CVE-2023-20107

highpriority · track · 30EPSS 0.007 · 54 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.72% (54th) EPSS

CVSS 7.5 · high

Is it mine?

74 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisco_csaf

EPSS · scored 2026-10-27

A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG), in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. This vulnerability is due to insufficient entropy in the DRBG for the affected hardware platforms when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.1 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.1.5 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.1.7 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.14 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.15 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.17 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.20 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.24 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.26 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.28 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.33 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.35 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.38 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.45 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.11 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.14 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.16 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.18 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.21 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.26 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.29 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.10 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.12 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.15 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.17 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.20 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.22 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.25 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.26 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.29 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.32 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.33 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.34 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.35 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.39 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.40 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.41 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.43 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.44 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.45 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.46 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.48 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.7 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.17 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.18 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.7 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.1 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.1.5 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.1.7 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.14 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.15 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.17 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.20 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.24 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.26 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.28 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.33 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.35 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.38 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.45 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.2.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.11 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.14 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.16 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.18 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.21 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.26 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.29 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.3.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.10 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.12 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.15 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.17 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.20 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.22 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.25 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.26 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.29 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.32 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.33 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.34 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.35 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.39 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.40 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.41 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.43 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.44 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.45 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.46 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.48 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.7 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.8.4.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.1 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.10 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.11 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.12 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.13 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.14 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.15 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.16 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.17 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.18 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.2 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.3 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.4 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.5 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.6 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.7 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.8 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
WorkaroundCisco Secure Firewall Threat Defense (FTD) Software 6.2.3.9 when installed on Cisco ASA 5500-X Series Firewallscisco_csaf
There is a workaround that addresses this vulnerability for cryptographic keys that are used with SSL/TLS features only. Cryptographic keys for use with SSH cannot be imported to the device, so there is no workaround for SSH. To avoid the use of potentially weak cryptographic keys, administrators can generate a key pair and a corresponding certificate on a trusted device outside of the Cisco ASA or Cisco FTD device and then import the base 64 encoded PKCS #12 file that contains the keys and certificate(s) to the Cisco ASA or Cisco FTD device using the crypto ca import <trust-point-name> pkcs12 <passphrase> command in global configuration mode. For more details, including steps for how to accomplish this task using the Cisco Adaptive Security Device Manager (ASDM), see ASA 8.x: Renew and Install the SSL Certificate with ASDM ["https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107956-renew-ssl.html#proc"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.3–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · psirt@cisco.com USexploitability 3.9 · impact 1.4

v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · Cisco PSIRT US

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-331USprimaryCWE-332USCWE-332US

affected products (74)

Products and version ranges known to be affected.

showing 20 of 74

advisories (1)

Vendor and ecosystem advisories describing this.

cisco-sa-asa5500x-entropy-6v9bHVYPCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability2023-03-22csaf · cisco_csafUS
A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG), in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. This vulnerability is due to insufficient entropy in the DRBG for the affected hardware platforms when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability for some affected configurations.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisco_csaf NVD CVE.org MITRE

published 2023-03-23modified 2026-08-11

related (185)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2008-1447US	medium6.8	95.2% (100th)	Exploit	2008-07-08
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; an…
CVE-2018-18326US	high7.5	54.3% (99th)	Exploit	2019-07-03
DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete…
CVE-2004-0230US	medium5.0	80.3% (100th)	Exploit	2004-08-18
TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by…
CVE-2018-15812US	high7.5	47.2% (99th)	Exploit	2019-07-03
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
CVE-2000-0384US	high10.0OT high	5.89% (93rd)	Exploit	2000-05-08
NetStructure 7110 and 7180 have undocumented accounts (servnow, root, and wizard) whose passwords are easily guessable from the NetStructure's MAC address, which could allow remote…

+180 more

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan