CVE-2025-20127: Cisco Adaptive Security Appliance (ASA) Software · Improper Resource Shutdown or Release
Affects Cisco Adaptive Security Appliance (ASA) SoftwareSource CVE Database V5
Not known to be exploited · CVSS 7.7 High.
Data as of 26 Oct 2026, 09:08 UTC
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 51% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HExploitation evidence
Disclosed: evidence found.
CVE published 14 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Adaptive Security Appliance (ASA) Software | Affected
| Fixed in– |
AI-suggested
To mitigate this vulnerability, European organizations should first identify all affected Cisco ASA and Firepower devices running the vulnerable software versions. 2) Temporarily disabling or restricting the use of the TLS_CHACHA20_POLY1305_SHA256 cipher in TLS 1.3 configurations on affected devices to prevent exploitation. This may involve adjusting cipher suite preferences or disabling TLS 1.3 if feasible without impacting business operations. 3) Implementing rate limiting or connection throttling on TLS connections to reduce the risk of resource exhaustion from high-volume connection attempts. 4) Enhancing network monitoring to detect unusual spikes in TLS 1.3 connection attempts, especially those using the vulnerable cipher, enabling early detection of exploitation attempts. 5) Preparing incident response plans that include procedures for rapid device reloads and failover to redundant systems to minimize downtime. 6) Reviewing and tightening access controls to ensure only authorized users can establish TLS connections requiring authentication, reducing the attack surface. These steps go beyond generic advice by focusing on cipher-specific configuration changes, proactive monitoring, and operational readiness for recovery.
Description
A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Cisco Firepower 3100 and 4200 Series devices could allow an authenticated, remote attacker to consume resources that are associated with incoming TLS 1.3 connections, which eventually could cause the device to stop accepting any new SSL/TLS or VPN requests. This vulnerability is due to the implementation of the TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. An attacker could exploit this vulnerability by sending a large number of TLS 1.3 connections with the specific TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. A successful exploit could allow the attacker to cause a denial of service (DoS) condition where no new incoming encrypted connections are accepted. The device must be reloaded to clear this condition. Note: These incoming TLS 1.3 connections include both data traffic and user-management traffic. After the device is in the vulnerable state, no new encrypted connections can be accepted.