CVE-2025-20224: Cisco Adaptive Security Appliance (ASA) Software · Memory Leak
Affects Cisco Adaptive Security Appliance (ASA) SoftwareSource CVE Database V5
Not known to be exploited · CVSS 5.8 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 53% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 14 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Adaptive Security Appliance (ASA) Software | Affected
| Fixed in– |
AI-suggested
European organizations should prioritize the following mitigation steps: 1) Inventory and identify all Cisco ASA and FTD devices running affected software versions to assess exposure. 2) Monitor Cisco's official security advisories and promptly apply vendor-released patches or software updates that address CVE-2025-20224 once available. 3) Implement network-level filtering to restrict or rate-limit incoming IKEv2 traffic from untrusted or external sources to reduce the risk of continuous crafted packet streams. 4) Deploy intrusion detection/prevention systems (IDS/IPS) with signatures or heuristics capable of detecting anomalous IKEv2 packet patterns indicative of exploitation attempts. 5) Establish robust monitoring and alerting for memory usage and VPN session failures on ASA devices to detect early signs of exploitation. 6) Prepare incident response procedures that include rapid device reboot protocols and communication plans to minimize downtime. 7) Consider segmenting VPN infrastructure and limiting exposure of ASA management interfaces to reduce attack surface. 8) Engage with Cisco support for guidance and potential workarounds if immediate patching is not feasible. These steps go beyond generic advice by focusing on proactive detection, network-level controls, and operational readiness specific to this vulnerability's exploitation method.
Description
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition. This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to partially exhaust system memory, causing system instability like being unable to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.