STIGQter STIGQter: STIG Summary: Cisco ASA NDM Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Cisco ASA must be configured to prohibit the use of all unnecessary and/or non-secure functions, ports, protocols, and/or services.

DISA Rule

SV-239911r1043177_rule

Vulnerability Number

V-239911

Group Title

SRG-APP-000142-NDM-000245

Rule Version

CASA-ND-000430

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Disable features that should not be enabled unless required for operations.

ASA(config)# no http server enable
ASA(config)# no telnet 10.1.22.2 255.255.255.255 INSIDE
ASA(config)# end

Note: Telnet must always be disabled.

Check Contents

Verify the ASA does not have any unnecessary or non-secure ports, protocols, and services enabled. For example, the following features such as telnet should never be enabled, while other features should only be enabled if required for operations. In the example below, http and telnet service are enabled.

http server enable
…
…
…
telnet 10.1.22.2 255.255.255.255 INSIDE

Note: The command http server enables https and is required for ASDM.

If any unnecessary or non-secure ports, protocols, or services are enabled, this is a finding.

Vulnerability Number

V-239911

Documentable

False

Rule Version

CASA-ND-000430

Severity Override Guidance

Verify the ASA does not have any unnecessary or non-secure ports, protocols, and services enabled. For example, the following features such as telnet should never be enabled, while other features should only be enabled if required for operations. In the example below, http and telnet service are enabled.

http server enable
…
…
…
telnet 10.1.22.2 255.255.255.255 INSIDE

Note: The command http server enables https and is required for ASDM.

If any unnecessary or non-secure ports, protocols, or services are enabled, this is a finding.

Check Content Reference

M

Target Key

5342