CVE-2025-20135: Cisco Adaptive Security Appliance (ASA) Software · Memory Leak
Affects Cisco Adaptive Security Appliance (ASA) SoftwareSource CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 14 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Adaptive Security Appliance (ASA) Software | Affected
| Fixed in– |
AI-suggested
European organizations should prioritize the following specific mitigation steps: 1) Conduct an immediate inventory of Cisco ASA and FTD devices to identify affected software versions. 2) Engage with Cisco's official security advisories and support channels to obtain and apply any available patches or software updates addressing this vulnerability as soon as they are released. 3) Implement network segmentation best practices to restrict DHCP traffic to trusted segments and limit exposure of ASA/FTD DHCP clients to untrusted adjacent networks. 4) Employ DHCP snooping and filtering on switches to block malicious or malformed DHCP packets from reaching firewall devices. 5) Monitor network traffic for unusual DHCP packet patterns indicative of exploitation attempts. 6) Prepare incident response plans that include rapid detection and manual reboot procedures to minimize downtime if a DoS occurs. 7) Consider deploying redundant firewall appliances or high-availability configurations to maintain service continuity during potential attacks. 8) Review and harden firewall configurations to minimize unnecessary DHCP client usage on ASA/FTD devices where possible. These targeted actions go beyond generic advice by focusing on controlling DHCP traffic exposure and operational readiness for recovery.
Description
A vulnerability in the DHCP client functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to exhaust available memory. This vulnerability is due to improper validation of incoming DHCP packets. An attacker could exploit this vulnerability by repeatedly sending crafted DHCPv4 packets to an affected device. A successful exploit could allow the attacker to exhaust available memory, which would affect availability of services and prevent new processes from starting, resulting in a Denial of Service (DoS) condition that would require a manual reboot. Note: On Cisco Secure FTD Software, this vulnerability does not affect management interfaces.