CVE-2025-20268

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-20268", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2024-10-10T19:15:13.244Z", "datePublished": "2025-08-14T16:30:34.427Z", "dateUpdated": "2025-08-14T19:18:58.227Z"}, "containers": {"cna": {"title": "Cisco Secure Firewall Threat Defense Software Geolocation Remote Access VPN Bypass Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "baseScore": 5.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Geolocation-Based Remote Access (RA) VPN feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies to allow or deny HTTP connections based on a country or region.\r\n\r\nThis vulnerability exists because the URL string is not fully parsed. An attacker could exploit this vulnerability by sending a crafted HTTP connection through the targeted device. A successful exploit could allow the attacker to bypass configured policies and gain access to a network where the connection should have been denied."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-ravpn-geobypass-9h38M37Z", "name": "cisco-sa-ftd-ravpn-geobypass-9h38M37Z"}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-ftd-ravpn-geobypass-9h38M37Z", "discovery": "EXTERNAL", "defects": ["CSCwo56698"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Handling of Values", "type": "cwe", "cweId": "CWE-229"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Firepower Threat Defense Software", "versions": [{"version": "7.7.0", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-08-14T16:30:34.427Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-14T18:37:19.704659Z", "id": "CVE-2025-20268", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-14T19:18:58.227Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20268", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-14T18:37:19.704659Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-14T18:37:23.782Z"}}], "cna": {"title": "Cisco Secure Firewall Threat Defense Software Geolocation Remote Access VPN Bypass Vulnerability", "source": {"defects": ["CSCwo56698"], "advisory": "cisco-sa-ftd-ravpn-geobypass-9h38M37Z", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Firepower Threat Defense Software", "versions": [{"status": "affected", "version": "7.7.0"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-ravpn-geobypass-9h38M37Z", "name": "cisco-sa-ftd-ravpn-geobypass-9h38M37Z"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Geolocation-Based Remote Access (RA) VPN feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies to allow or deny HTTP connections based on a country or region.\r\n\r\nThis vulnerability exists because the URL string is not fully parsed. An attacker could exploit this vulnerability by sending a crafted HTTP connection through the targeted device. A successful exploit could allow the attacker to bypass configured policies and gain access to a network where the connection should have been denied."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-229", "description": "Improper Handling of Values"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-08-14T16:30:34.427Z"}}}, "cveMetadata": {"cveId": "CVE-2025-20268", "state": "PUBLISHED", "dateUpdated": "2025-08-14T19:18:58.227Z", "dateReserved": "2024-10-10T19:15:13.244Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2025-08-14T16:30:34.427Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Cisco Firepower Threat Defense Software", "vendor": "Cisco", "versions": [{"status": "affected", "version": "7.7.0"}]}], "source": "psirt@cisco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the Geolocation-Based Remote Access (RA) VPN feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies to allow or deny HTTP connections based on a country or region.\r\n\r\nThis vulnerability exists because the URL string is not fully parsed. An attacker could exploit this vulnerability by sending a crafted HTTP connection through the targeted device. A successful exploit could allow the attacker to bypass configured policies and gain access to a network where the connection should have been denied."}, {"lang": "es", "value": "Una vulnerabilidad en la funci\u00f3n VPN de acceso remoto (RA) basado en geolocalizaci\u00f3n del software Cisco Secure Firewall Threat Defense (FTD) podr\u00eda permitir que un atacante remoto no autenticado eluda las pol\u00edticas configuradas para permitir o denegar conexiones HTTP seg\u00fan un pa\u00eds o regi\u00f3n. Esta vulnerabilidad existe porque la URL no se analiza completamente. Un atacante podr\u00eda explotar esta vulnerabilidad enviando una conexi\u00f3n HTTP manipulada a trav\u00e9s del dispositivo objetivo. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante eludir las pol\u00edticas configuradas y obtener acceso a una red donde la conexi\u00f3n deber\u00eda haber sido denegada."}], "id": "CVE-2025-20268", "lastModified": "2026-06-17T08:41:13.937", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20268", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-14T18:37:19.704659Z", "version": "2.0.3"}}]}, "published": "2025-08-14T17:15:39.903", "references": [{"source": "psirt@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-ravpn-geobypass-9h38M37Z"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-229"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"created": "2025-08-15T08:07:49.393518+00:00", "updated": "2025-08-15T08:07:49.393568+00:00", "vendors": ["cisco", "cisco$PRODUCT$firepower_threat_defense_software"]}