Cisco Adaptive Security Appliance IPv6 NAT Denial of Service Vulnerability

A vulnerability in the function that performs IP version 6 (IPv6) Network Address Translation (NAT) for Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of an affected system.

The vulnerability is due to improper implementation of the logic that performs NAT when the Cisco ASA is configured for NAT64 or NAT66. This vulnerability can be triggered only under specific configurations. An attacker could exploit this vulnerability by sending packets matching one of the NAT rules through the affected system. An exploit could allow the attacker to cause a reload of the system, leading to a denial of service (DoS) condition.

Cisco has confirmed the vulnerability in a security notice and released software updates.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.