Cisco Adaptive Security Appliance DHCPv6 Relay Denial of Service Vulnerability

A vulnerability in the DHCP relay function of Cisco Adaptive Security Appliance (ASA) software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device.

The vulnerability is due to insufficient validation of crafted DHCP packets. Cisco ASA Software is affected by this vulnerability only when configured as a DHCP version 6 relay. An attacker could exploit this vulnerability by sending crafted DHCP version 6 packets through an affected device.

Cisco has confirmed the vulnerability in a security notice and released software updates.

To exploit this vulnerability, an attacker must be on the same broadcast or collision domain as a targeted device. This access requirement reduces the likelihood of a successful exploit.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.