CVE-2025-20134: Cisco Adaptive Security Appliance (ASA) Software · Double Free
Affects Cisco Adaptive Security Appliance (ASA) SoftwareSource CVE Database V5
Not known to be exploited · CVSS 8.6 High.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 35% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitation evidence
Disclosed: evidence found.
CVE published 14 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Adaptive Security Appliance (ASA) Software | Affected
| Fixed in– |
AI-suggested
To mitigate this vulnerability, European organizations should prioritize the following actions: 1) Immediately identify and inventory all Cisco ASA and FTD devices running affected software versions. 2) Apply Cisco’s security patches or software updates as soon as they become available to address CVE-2025-20134. If patches are not yet released, consider temporary mitigations such as disabling DNS inspection or static NAT rules that match DNS traffic on affected devices, if operationally feasible. 3) Implement network segmentation and access control lists to restrict untrusted sources from sending DNS traffic to firewall management or inspection interfaces. 4) Monitor firewall logs and network traffic for anomalous DNS packets or unexpected device reloads that could indicate attempted exploitation. 5) Establish incident response procedures to quickly detect and recover from potential DoS events caused by this vulnerability. 6) Engage with Cisco support and subscribe to security advisories to receive timely updates. 7) Conduct penetration testing and vulnerability assessments focusing on firewall configurations to ensure no exploitable exposure remains. These steps go beyond generic advice by focusing on specific configuration changes (disabling DNS inspection on static NAT rules) and proactive monitoring tailored to this vulnerability’s exploitation vector.
Description
A vulnerability in the certificate processing of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper parsing of SSL/TLS certificates. An attacker could exploit this vulnerability by sending crafted DNS packets that match a static Network Address Translation (NAT) rule with DNS inspection enabled through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.