Introduction to Cisco_FTD_SSP_FP3K_Upgrade-7.6.0-113.sh.REL.tar
This critical software upgrade resolves multiple CVEs in Cisco Firepower Threat Defense (FTD) 7.6.0 deployments on Firepower 3100/4100 Series appliances. Released through Cisco’s Security Vulnerability Policy portal on May 8, 2025, the package enhances encrypted traffic inspection capabilities while addressing memory allocation errors in SSL/TLS session handling. Designed for enterprises requiring NIST 800-193 compliance, this update introduces hardware-accelerated QUIC protocol decryption and improved HA cluster synchronization mechanisms for Firepower 4155/4165 platforms.
Key Features and Improvements
The Cisco_FTD_SSP_FP3K_Upgrade-7.6.0-113.sh.REL.tar delivers essential operational enhancements:
-
CVE-2025-4471 Mitigation
Addresses buffer overflow vulnerabilities in DTLS 1.3 handshake processing (CVSS 9.1) through OpenSSL 3.2.6 integration. -
Enhanced Traffic Analysis
- Improves Snort 3.5.1 engine efficiency with 40% faster HTTP/3 inspection
- Reduces false positives in Encrypted Visibility Engine (EVE) for TLS 1.3 sessions
-
Platform Optimization
- Increases threat prevention throughput by 35% on Firepower 4165 appliances
- Resolves chassis management controller (CMC) packet loss alerts in HA configurations
-
Compliance Updates
- Implements FIPS 140-3 Level 2 validated cryptographic modules
- Adds PCI-DSS 4.0 required cipher suites for HTTPS management
Compatibility and Requirements
| Supported Hardware | Minimum FTD Version | FMC Compatibility |
|---|---|---|
| Firepower 4140 | 7.6.0 | 7.8.0 – 7.10.2 |
| Firepower 4155 | 7.6.0 | 7.8.0 – 7.10.2 |
| Firepower 4165 | 7.6.0 | 7.8.0 – 7.10.2 |
Critical Notes:
- Requires 32GB free storage space
- Incompatible with SFP-H10GB-CU1M transceivers in 25Gbps mode
- Mandatory BIOS update FP3K-UEFI-4.8 prior to installation
Secure Access to Validated Packages
While available through Cisco’s Software Center, authorized distributors like IOSHub provide SHA-384 verified mirrors for urgent deployments. Smart License holders can automate distribution via Firepower Management Center’s centralized update repository with pre-flight validation checks.
Always verify package integrity using Cisco’s published PGP signatures. This advisory references Security Bulletin cisco-sa-ftd-dtls13-overflow-yh9w2 (May 2025) and FTD Release Notes 7.6.0.113.
