Cisco Secure Firewall Threat Defense Software Geolocation Remote Access VPN Bypass Vulnerability

🚨SEVERITY: MEDIUM — CVSS 5.8Security Advisory

TL;DR 📌

  • A vulnerability in the Geolocation-Based Remote Access (RA) VPN feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies to allow or deny HTTP connections based on a country or region. This vulnerability exists because the URL string is not fully parsed. An attacker could exploit…
  • Highest CVSS: 5.8 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20268.

What it is

CVE-2025-20268 affects the Geolocation-Based Remote Access (RA) VPN feature in Cisco Secure Firewall Threat Defense (FTD) Software. The feature is new as of FTD Release 7.7.0, and the flaw only applies to devices running that release with Geolocation-Based RA VPN enabled.

The bug is a URL parsing failure: FTD does not fully parse the URL string when evaluating an HTTP connection against configured geolocation policy. An unauthenticated, remote attacker can send a crafted HTTP connection through the device and have it evaluated incorrectly, causing the device to allow a connection that the policy was configured to deny based on country or region.

This is a data-plane policy bypass, not a device compromise — there’s no code execution or credential exposure involved. The practical effect is that traffic which should have been blocked by country/region rules reaches the network instead. Cisco has confirmed that ASA Software and Secure FMC Software are not affected; this is specific to FTD’s geolocation RA VPN handling.

Cisco PSIRT states it is not aware of any public announcements or malicious use of this vulnerability, and there is no CISA KEV listing.

What to do

  • Check whether any of your FTD devices are running Release 7.7.0 with Geolocation-Based RA VPN configured — this is the only combination affected.
  • There are no workarounds; the only remediation is upgrading. Use the Cisco Software Checker against your specific FTD release to get the “First Fixed” and “Combined First Fixed” version for your platform, since fixed versions are not laid out as a simple single number in the advisory.
  • Treat this as one item in the August 2025 Cisco Secure Firewall ASA/FMC/FTD bundled advisory release — if you’re patching FTD for other advisories in that bundle, roll this fix in at the same time.
  • After upgrading, re-verify that geolocation allow/deny behaviour matches your configured country/region policy before relying on it for access control decisions.

For leadership 🧭

Executive summary. Firewalls running FTD 7.7.0 with Geolocation-Based RA VPN enabled can be tricked into letting through HTTP connections from countries or regions that were meant to be blocked, undermining a control that’s presumably there for compliance or threat-reduction reasons. There’s no known exploitation and no device compromise involved, so this can go through a normal patch cycle rather than an emergency change.

Why it matters:

  • Only affects FTD devices on Release 7.7.0 with Geolocation-Based RA VPN switched on — check that combination specifically before assuming exposure
  • An unauthenticated attacker just needs to send a crafted HTTP connection through the device; no credentials or prior access required
  • Impact is a silent policy bypass — traffic that should be blocked by country/region rules reaches the internal network instead, with no alert that the control failed
  • No workaround exists, so any device matching the vulnerable configuration stays exposed until it’s upgraded

Now / Next / Later:

  • Now: Identify which FTD devices are running Release 7.7.0 with Geolocation-Based RA VPN configured — that is the entire exposed population.
  • Next: Run the Cisco Software Checker against each affected FTD release to get the First Fixed / Combined First Fixed version, and schedule the upgrade alongside any other fixes from the August 2025 ASA/FMC/FTD bundle you’re already applying.
  • Later: After upgrading, re-test geolocation allow/deny behaviour against your configured country/region rules so you have positive confirmation the control works as intended, not just that the patch installed.

Source