Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software SSL/TLS Certificate Denial of Service Vulnerability

🚨SEVERITY: HIGH — CVSS 8.6Security Advisory

TL;DR 📌

  • A vulnerability in the certificate processing of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper parsing of SSL/TLS certificates. An…
  • Highest CVSS: 8.6 (High).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20134.

What it is

CVE-2025-20134 is a denial-of-service flaw in how Cisco Secure Firewall ASA Software and Secure FTD Software parse SSL/TLS certificates. The bug sits in the certificate-processing code path, not in a management interface.

The trigger is unusual: an attacker sends crafted DNS packets through the affected device. If those packets match a static NAT rule that has DNS inspection enabled, the malformed certificate handling is invoked and the device reloads. This is a data-plane attack — it rides on traffic the firewall is already inspecting, not on an administrative session.

Two conditions need to be in place for a device to be reachable. First, the device must have an SSL/TLS listening socket active, which happens when features such as the HTTP server (http server enable) or SSL VPN (webvpn with an enabled interface) are configured. Second, the traffic path in question must include a static NAT rule with DNS inspection turned on. Cisco’s advisory gives a CLI check — show asp table socket | include SSL — to confirm whether a listening socket exists.

No authentication is required, and the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base score 8.6, High) reflects a low-complexity network attack with no privileges or user interaction needed, and a scope change with full impact on availability — the device reloads. Cisco Secure FMC Software is confirmed not affected. Cisco states it is not aware of any public announcement or malicious use of this vulnerability, and it is not listed in CISA’s KEV catalogue.

What to do

  • Confirm exposure first: run show asp table socket | include SSL on ASA/FTD devices to see if an SSL/TLS listening socket is present, and check whether any static NAT rules have DNS inspection enabled.
  • There is no workaround — Cisco states this explicitly. Patching is the only mitigation.
  • Use Cisco’s Fixed Software section and the Cisco Software Checker to identify the correct fixed release for your specific platform and current version (the advisory’s guidance references entering your running release, e.g. an ASA or FTD version, into the checker tool). The affected range is described as ASA Software Release 9.15 or earlier and Secure FTD Software Release 6.7 or earlier — verify your own version against the advisory rather than assuming you’re outside this range.
  • FTD devices are upgraded via the appropriate Secure FMC upgrade guide referenced in the advisory, not standalone.
  • This advisory is part of Cisco’s August 2025 semiannual ASA/FMC/FTD bundled publication — worth checking the linked event response for any other advisories in the same bundle affecting your deployment.

For leadership 🧭

Executive summary. An unauthenticated attacker who can send DNS traffic through an ASA or FTD device with the right NAT configuration can force the firewall to reload, interrupting all traffic it handles. There is no workaround, so this needs to move to a patching change window rather than sit on a backlog.

Why it matters:

  • The flaw is reachable via ordinary data-plane traffic — crafted DNS packets matching a static NAT rule with DNS inspection enabled — not via a management session, so perimeter access controls on admin interfaces won’t stop it.
  • No authentication or user interaction is required, and the CVSS 8.6 score reflects a scope change with full impact on availability: a successful trigger reloads the device outright.
  • Any device with an active SSL/TLS listening socket is in scope, which includes common configurations such as the HTTP server or SSL VPN (webvpn) being enabled, not just management-plane services.
  • Cisco Secure FMC Software is confirmed unaffected, but ASA Release 9.15 and earlier and FTD Release 6.7 and earlier are affected, so unpatched perimeter firewalls remain exposed until upgraded.

Now / Next / Later:

  • Now: Run show asp table socket | include SSL on each ASA/FTD device to confirm whether an SSL/TLS listening socket is active, and check for static NAT rules with DNS inspection enabled to establish real exposure.
  • Next: Schedule an upgrade of exposed ASA and FTD devices to the fixed releases identified via Cisco’s Software Checker, upgrading FTD through the appropriate Secure FMC upgrade guide since there is no workaround available.
  • Later: Review why DNS-inspecting NAT rules and SSL-exposing features (HTTP server, SSL VPN) are enabled on internet-facing firewalls, and build the CLI exposure check into routine firewall configuration audits going forward.

Source