CVE-2025-20254

View on CVE.org
Published Aug 14, 2025 CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition.

This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to partially exhaust system memory, causing system instability like being unable to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-24876 A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition. This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to partially exhaust system memory, causing system instability like being unable to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.
History
Type Values Removed Values Added
First Time appeared Cisco
Cisco adaptive Security Appliance Software
Cisco firepower Threat Defense Software
Vendors & Products Cisco
Cisco adaptive Security Appliance Software
Cisco firepower Threat Defense Software
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Multiple vulnerabilities in the IKEv2 feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a DoS condition. These vulnerabilities are due to the improper processing of IKEv2 packets. An attacker could exploit these vulnerabilities by sending crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to partially exhaust system memory, causing system instability such as being unable to establish new IKEv2 VPN sessions, which requires a manual reboot of the device to recover from this condition. A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition. This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to partially exhaust system memory, causing system instability like being unable to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.
Title Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Denial of Service Vulnerability
Type Values Removed Values Added
Description Multiple vulnerabilities in the IKEv2 feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a DoS condition. These vulnerabilities are due to the improper processing of IKEv2 packets. An attacker could exploit these vulnerabilities by sending crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to partially exhaust system memory, causing system instability such as being unable to establish new IKEv2 VPN sessions, which requires a manual reboot of the device to recover from this condition.
Title Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Denial of Service Vulnerability
Weaknesses CWE-401
References
Metrics cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
cisco
Published
Updated
Aug 14, 2025, 7:19 PM
Reserved
Oct 10, 2024, 7:15 PM

View source JSON

Updated
Aug 14, 2025, 6:37 PM

JSON

Status
Deferred
Published
Aug 14, 2025, 5:15 PM
Modified
Jun 17, 2026, 8:41 AM

View source JSON

No data.

Updated
Aug 15, 2025, 8:07 AM

JSON