CVE-2025-20133: Cisco Adaptive Security Appliance (ASA) Software · Memory Leak
Affects Cisco Adaptive Security Appliance (ASA) SoftwareSource CVE Database V5
Not known to be exploited · CVSS 8.6 High.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 55% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitation evidence
Disclosed: evidence found.
CVE published 14 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Adaptive Security Appliance (ASA) Software | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-20133, European organizations should prioritize the following actions: 1) Immediate deployment of Cisco's security patches or software updates addressing this vulnerability once available. Given the broad range of affected versions, organizations must verify their ASA software version and apply the relevant fixes promptly. 2) Implement network-level protections such as rate limiting and access control lists (ACLs) to restrict and monitor traffic to the Remote Access SSL VPN service, reducing exposure to crafted malicious requests. 3) Employ VPN gateway redundancy and failover mechanisms to maintain remote access availability in case of an attack-induced DoS on one device. 4) Monitor VPN authentication logs and network traffic for unusual patterns indicative of exploitation attempts, enabling early detection and response. 5) Consider temporarily disabling the Remote Access SSL VPN feature if feasible and until patches are applied, especially in high-risk environments. 6) Conduct thorough testing of updated ASA software in controlled environments before deployment to ensure stability and compatibility. 7) Educate IT and security teams about the vulnerability specifics and response procedures to enhance preparedness. These targeted measures go beyond generic advice by focusing on immediate patching, network-level defenses, operational continuity, and proactive monitoring tailored to the nature of this vulnerability.
Description
A vulnerability in the management and VPN web servers of the Remote Access SSL VPN feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to unexpectedly stop responding, resulting in a DoS condition. This vulnerability is due to ineffective validation of user-supplied input during the Remote Access SSL VPN authentication process. An attacker could exploit this vulnerability by sending a crafted request to the VPN service on an affected device. A successful exploit could allow the attacker to cause a DoS condition where the device stops responding to Remote Access SSL VPN authentication requests.