Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerabilities

🚨SEVERITY: HIGH — CVSS 8.6Security Advisory

TL;DR 📌

  • Multiple vulnerabilities in the management and VPN web servers for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to stop responding or reload unexpectedly, resulting in a denial of service (DoS) condition. These vulnerabilities are due to…
  • Highest CVSS: 8.6 (High).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20133, CVE-2025-20243.

What it is

Cisco has published two related denial-of-service vulnerabilities affecting the management and VPN web servers on Secure Firewall ASA Software and Secure FTD Software: CVE-2025-20133 and CVE-2025-20243. Both carry a CVSS base score of 8.6 (High) and neither depends on the other — a device can be affected by one, both, or neither depending on which release and features it runs.

CVE-2025-20133 sits in the Remote Access SSL VPN authentication process. It stems from ineffective validation of user-supplied input during authentication. An unauthenticated, remote attacker sends a crafted request to the VPN service, and the device stops responding to further Remote Access SSL VPN authentication requests.

CVE-2025-20243 is in the VPN web services interface. It results from improper validation of user-supplied input, exploited by sending crafted HTTP requests to the device’s web server. A successful attempt causes the device to reload.

Both flaws require an SSL listen socket to be present — Cisco gives the CLI check show asp table socket | include SSL to confirm this. On ASA, the relevant configurations include AnyConnect IKEv2 remote access, management web server access (including ASDM/CSM), Mobile User Security, and SSL VPN. On FTD, the exposure comes from AnyConnect IKEv2 remote access, AnyConnect SSL VPN, or HTTP server enablement (configured via FMC or FDM). Cisco has confirmed Secure FMC Software itself is not affected. Access in both cases is unauthenticated and over the network, targeting the VPN or management web server rather than any data-plane traffic path.

What to do

  • Run show asp table socket | include SSL on ASA/FTD devices to check whether an SSL listen socket is present on any TCP port — if it is, treat the device as exposed.
  • Cross-check running configuration against the vulnerable feature indicators Cisco lists: crypto ikev2 enable ... client-services port, http server enable, webvpn/mus server enable, and enable <interface_name> under webvpn.
  • Apply the fixed software release identified for your specific ASA or FTD version via the Cisco Software Checker (search using this advisory ID, or “All Critical and High advisories”). There are no workarounds for either CVE, so patching is the only mitigation.
  • For FTD, plan upgrades through Secure FMC using the standard FTD upgrade guide, since remote access VPN and HTTP settings are managed there.
  • Where features like management HTTP access or MUS have restricted access-host lists, confirm those lists are as tight as operationally possible while you schedule the update, since Cisco notes some features are only reachable from configured access-host IP addresses.
  • Neither CVE is listed in CISA KEV, and Cisco PSIRT states it is not aware of public announcements or malicious use of either vulnerability at the time of publication.

For leadership 🧭

Executive summary. Any Cisco ASA or FTD firewall running SSL VPN, AnyConnect, ASDM/CSM management access, or Mobile User Security can be knocked offline or forced to reload by a single unauthenticated network request. There are no workarounds, so this needs a scheduled patch rather than a configuration fix, and it should be treated as urgent for any internet-facing VPN gateway.

Why it matters:

  • An attacker who can reach the VPN or management web server on TCP port 443 (or whichever port is configured) can stop the device responding to Remote Access SSL VPN authentication (CVE-2025-20133) or force a full reload (CVE-2025-20243), with no login required.
  • Affected features are common in production: AnyConnect IKEv2 remote access, SSL VPN, ASDM/CSM management access, Mobile User Security on ASA, and AnyConnect SSL VPN or HTTP server access on FTD.
  • Cisco Secure FMC itself is confirmed unaffected, so the exposure sits specifically on the ASA/FTD boxes terminating VPN and management traffic, not on the management platform behind them.
  • Since there is no workaround, any exposed device stays vulnerable to remote disruption until the firewall software itself is upgraded.

Now / Next / Later:

  • Now: Run show asp table socket | include SSL on every ASA and FTD device to identify which ones have an SSL listen socket open, and check running config against Cisco’s listed feature indicators (webvpn, http server enable, crypto ikev2 client-services, mus server enable).
  • Next: Patch confirmed-exposed ASA and FTD devices to the fixed release identified via the Cisco Software Checker in the next available change window, prioritising internet-facing VPN gateways and management interfaces; for FTD, push the upgrade through Secure FMC.
  • Later: Where ASDM/CSM management access or Mobile User Security must stay enabled, tighten the configured access-host IP lists to the minimum required set, and build SSL-socket exposure checks into routine ASA/FTD configuration audits so future advisories can be triaged quickly.

Source