CVE-2025-20243: Cisco Adaptive Security Appliance (ASA) Software · Infinite Loop
Affects Cisco Adaptive Security Appliance (ASA) SoftwareSource CVE Database V5
Not known to be exploited · CVSS 8.6 High.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 49% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitation evidence
Disclosed: evidence found.
CVE published 14 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Adaptive Security Appliance (ASA) Software | Affected
| Fixed in– |
AI-suggested
To mitigate this vulnerability effectively, European organizations should take the following specific actions: 1) Immediately identify all Cisco ASA and Secure FTD devices in their environment and verify the software versions against the affected list. 2) Apply Cisco's security patches or software updates as soon as they become available, prioritizing devices exposed to untrusted networks. 3) Restrict access to management and VPN web interfaces by implementing strict network segmentation and firewall rules, allowing only trusted IP addresses to connect. 4) Disable or limit the use of web-based management interfaces where possible, favoring CLI or out-of-band management channels. 5) Monitor network traffic for unusual HTTP requests targeting ASA web services that could indicate exploitation attempts. 6) Implement robust logging and alerting on ASA devices to detect unexpected reloads or service interruptions promptly. 7) Conduct regular vulnerability assessments and penetration testing focused on firewall and VPN infrastructure to identify exposure. 8) Educate network and security teams on the specifics of this vulnerability to ensure rapid response and remediation. These measures go beyond generic advice by focusing on access control, monitoring, and operational readiness tailored to the nature of this vulnerability and the critical role of ASA devices.
Description
A vulnerability in the management and VPN web servers of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability is due to improper validation of user-supplied input on an interface with VPN web services. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on an affected device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.