CVE-2025-20252: Cisco Adaptive Security Appliance (ASA) Software · Memory Leak
Affects Cisco Adaptive Security Appliance (ASA) SoftwareSource CVE Database V5
Not known to be exploited · CVSS 5.8 Medium.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 37% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 14 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Adaptive Security Appliance (ASA) Software | Affected
| Fixed in– |
AI-suggested
To mitigate the risk posed by CVE-2025-20252, European organizations should take the following specific actions: 1) Identify and inventory all Cisco ASA and FTD devices in their environment, noting software versions to determine exposure. 2) Apply the latest Cisco patches or software updates that address this vulnerability as soon as they become available. 3) Implement network-level protections such as rate limiting or firewall rules to restrict or throttle incoming IKEv2 traffic from untrusted or external sources, reducing the risk of continuous crafted packet streams. 4) Deploy intrusion detection/prevention systems (IDS/IPS) with signatures or anomaly detection capabilities tuned to detect abnormal IKEv2 packet patterns indicative of exploitation attempts. 5) Establish robust monitoring and alerting for VPN service availability and device memory utilization to detect early signs of exploitation or resource exhaustion. 6) Develop and test incident response procedures that include rapid device reboot and recovery steps to minimize downtime. 7) Consider segmenting VPN infrastructure and limiting exposure of ASA/FTD management interfaces to reduce attack vectors. 8) Educate network operations teams about this vulnerability and ensure readiness to respond to potential DoS incidents. These targeted mitigations go beyond generic advice by focusing on proactive detection, traffic control, and operational readiness specific to the nature of this memory leak vulnerability in IKEv2 processing.
Description
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition. This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to partially exhaust system memory, causing system instability like being unable to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.