Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Web Services Denial of Service Vulnerability

🚨SEVERITY: HIGH — CVSS 8.6Security Advisory

TL;DR 📌

  • A vulnerability in the web services interface of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected system. This vulnerability is due to insufficient boundary checks for specific data that is provided to the…
  • Highest CVSS: 8.6 (High).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20263.

What it is

CVE-2025-20263 is a buffer overflow in the web services interface of Cisco Secure Firewall ASA Software and Secure FTD Software. It’s caused by insufficient boundary checks on data passed to that interface.

An unauthenticated, remote attacker can trigger it by sending a crafted HTTP request to the affected system. No credentials or prior access are needed — this is a data-plane/management-interface issue reachable over the network by anyone who can send HTTP traffic to it, subject to the access controls below.

Exploitation causes a buffer overflow condition that reloads the device, producing a denial of service. There’s no indication of code execution or data compromise — the impact is availability only, reflected in the CVSS vector (C:N/I:N/A:H).

The vulnerability only matters where the web services feature is actually enabled. On ASA, that means either Management Web Server Access (including ASDM and Cisco Security Manager) or the REST API, both configured via http server enable / http, and both restricted to whatever IP range is set in the http command. On FTD, it requires the HTTP server to be enabled, which is set via FMC (Platform Settings > HTTP) or FDM (Device > System Settings > Management Access). Cisco has confirmed Secure FMC Software is not affected. Cisco PSIRT states it is not aware of any public announcements or malicious use of this vulnerability.

What to do

  • Check whether Management Web Server Access, ASDM/CSM access, or the REST API is enabled on ASA (http server enable / http in the running config, plus rest-api image for REST API), and whether the HTTP server is enabled on FTD (via FMC Platform Settings > HTTP or FDM Management Access). If none of these are enabled, the device isn’t exposed to this issue.
  • Where enabled, tighten the IP range configured in the http command to the minimum needed for management access, since exposure is limited to addresses in that range — but note this is not a substitute for patching, as no workaround exists.
  • Apply the fixed ASA or FTD software release identified for your platform and train via Cisco’s Software Checker (enter your current release, e.g. 9.20.3.4 for ASA or 7.4.2 for FTD, against this specific advisory) to confirm the exact fixed version for your deployment.
  • Secure FMC Software does not need remediation for this issue.
  • Prioritise firewalls with internet-facing or otherwise broadly reachable management interfaces, since the attack path is a single crafted HTTP request with no authentication required.

For leadership 🧭

Executive summary. A remotely triggerable buffer overflow in the ASA/FTD web services interface lets anyone who can reach the management HTTP service knock the firewall offline with one crafted request, no credentials needed. There’s no workaround, so devices with ASDM, the REST API, or the HTTP server enabled should be patched as soon as a change window allows.

Why it matters:

  • The flaw sits in the web services interface used by ASDM, Cisco Security Manager, the ASA REST API, and the FTD HTTP server — features many teams enable for day-to-day management.
  • Exploitation needs no authentication, just a crafted HTTP request from any address within the configured http command range, and it forces the firewall to reload, cutting off the traffic it’s meant to be protecting.
  • There is no workaround; the only fix is upgrading to a patched ASA or FTD release, so exposed devices remain at risk until updated.
  • Secure FMC Software is confirmed unaffected, so remediation effort can be focused solely on ASA and FTD devices with management web access or REST API enabled.

Now / Next / Later:

  • Now: Check every ASA and FTD device for http server enable / http in the running config (and rest-api image on ASA), or HTTP server settings in FMC/FDM, to identify which units actually expose the vulnerable web services interface.
  • Next: For any device where management web access, ASDM/CSM, the REST API, or the FTD HTTP server is enabled, schedule an upgrade to the fixed ASA or FTD release for that platform, using Cisco’s Software Checker against this advisory to confirm the exact version.
  • Later: Restrict the IP ranges permitted in the http command to the minimum needed for management access on all ASA/FTD deployments, and review whether web management interfaces need to stay enabled at all on units that don’t require it.

Source