CVE-2025-20254
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow
Description
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition. This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to partially exhaust system memory, causing system instability like being unable to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.
Weakness: CWE-401
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Adaptive Security Appliance (ASA) Check your version | Firewall / NGFW | cna-assigner |
| Cisco | Cisco Firepower Threat Defense (FTD) Check your version | Firewall / NGFW | cna-assigner |
Vendor-reported products (2)
- Cisco · Cisco Adaptive Security Appliance (ASA) Software
- Cisco · Cisco Firepower Threat Defense Software
Vendor advisory
cisco-sa-asa-ftd-ios-dos-DOESHWHy
Cisco IOS, IOS XE, Secure Firewall Adaptive Security Appliance, and Secure Firewall Threat Defense Software IKEv2 Denial of Service Vulnerabilities
Cisco’s rating: High (advisory CVSS 8.6) · Published Aug 14, 2025
Bug IDs: CSCwn73399 , CSCwn83263 , CSCwo15021 , CSCwo15022 , CSCwo15023 , CSCwo15024 , CSCwo15026 , CSCwo20388 , CSCwo49928 , CSCwo49948
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from