CVE-2025-20127: Cisco Firepower Threat Defense DoS Flaw

CVE-2025-20127 Overview

CVE-2025-20127 is a denial-of-service vulnerability in the TLS 1.3 implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The flaw affects Cisco Firepower 3100 and 4200 Series devices. An authenticated, remote attacker can exhaust resources tied to incoming TLS 1.3 connections that negotiate the TLS_CHACHA20_POLY1305_SHA256 cipher. Once exploited, the device stops accepting new SSL/TLS or VPN requests, including both data plane and management traffic. Recovery requires a device reload. The vulnerability is tracked as CWE-404: Improper Resource Shutdown or Release.

Critical Impact

Successful exploitation halts all new encrypted connections on affected firewalls, severing VPN access and management traffic until the device is reloaded.

Affected Products

• Cisco Secure Firewall ASA Software (versions 9.20.1 through 9.22.1.1) on Firepower 3100/4200 Series
• Cisco Secure Firewall Threat Defense (FTD) Software 7.4.0, 7.4.1.x, 7.4.2.x, and 7.6.0
• Cisco Secure Firewall hardware models 3105, 3110, 3120, 3130, 3140, 4215, 4225, and 4245

Discovery Timeline

• 2025-08-14 - CVE-2025-20127 published to NVD
• 2025-08-25 - Last updated in NVD database

Technical Details for CVE-2025-20127

Vulnerability Analysis

The vulnerability resides in how the affected firewalls implement TLS 1.3 negotiation with the TLS_CHACHA20_POLY1305_SHA256 cipher suite. When a large volume of TLS 1.3 connections requesting this cipher reach the device, resources associated with those sessions are consumed but not properly released. Eventually the device reaches a state in which it cannot accept any new encrypted connections.

Because TLS 1.3 sessions on these platforms cover both data traffic and user-management traffic, the impact extends across the entire encrypted attack surface of the firewall. SSL VPN tunnels, AnyConnect/Secure Client sessions, HTTPS management, and other TLS-terminated services all stop accepting new connections. A device reload is the only documented recovery mechanism.

The issue is categorized under improper resource shutdown or release, indicating the cipher implementation fails to free session-associated state when connections complete or fail. Exploitation requires valid credentials, which constrains the attack surface to authenticated users on a network path to the device.

Root Cause

The TLS_CHACHA20_POLY1305_SHA256 cipher handler does not properly reclaim resources allocated for incoming TLS 1.3 sessions. Repeated session establishment using this specific cipher drives the device toward a state in which the connection-handling subsystem is exhausted and cannot service new requests.

Attack Vector

An authenticated remote attacker initiates a large number of TLS 1.3 connections to the affected firewall, explicitly negotiating the TLS_CHACHA20_POLY1305_SHA256 cipher suite. Each connection consumes resources that are not released. Once the threshold is reached, the device enters a state where new encrypted connections, including legitimate VPN and management sessions, are refused. The attack does not require local access or user interaction. The vulnerability has an EPSS score of 0.208% as of late May 2026, indicating low observed exploitation activity. No public proof-of-concept code or exploitation in the wild has been reported.

Detection Methods for CVE-2025-20127

Indicators of Compromise

• Sudden refusal of new SSL/TLS or VPN connections on Cisco Firepower 3100 or 4200 Series devices while the device otherwise appears operational.
• Elevated counts of incoming TLS 1.3 handshakes negotiating the TLS_CHACHA20_POLY1305_SHA256 cipher from a small set of source addresses.
• Inability of administrators to establish new HTTPS management sessions to the firewall.

Detection Strategies

• Monitor TLS handshake telemetry for abnormal volumes of TLS 1.3 connections selecting TLS_CHACHA20_POLY1305_SHA256 against ASA/FTD interfaces.
• Correlate authentication logs with TLS session counts to identify authenticated principals generating excessive TLS 1.3 traffic.
• Track firewall resource counters and SSL/TLS session statistics using show resource usage and related ASA/FTD commands to detect saturation trends.

Monitoring Recommendations

• Alert on sustained increases in failed or refused SSL VPN connection attempts following periods of high TLS 1.3 activity.
• Forward ASA/FTD syslog and SNMP data into a centralized analytics platform to baseline TLS session behavior and surface deviations.
• Audit credentialed access to firewall management planes regularly, as exploitation requires authenticated access.

How to Mitigate CVE-2025-20127

Immediate Actions Required

• Apply the fixed software releases published in the Cisco Security Advisory for TLS DoS.
• Restrict management plane access to trusted administrative networks using access control lists.
• Rotate or review credentials for any account with TLS/VPN access to affected firewalls, since exploitation requires authentication.
• Prepare an out-of-band recovery procedure, as remediation of the vulnerable state requires a device reload.

Patch Information

Cisco has published fixed releases for Cisco Secure Firewall ASA and FTD Software. Refer to the Cisco Security Advisory cisco-sa-3100_4200_tlsdos-2yNSCd54 for the specific fixed version mapped to each affected train (9.20.x, 9.22.x for ASA, and 7.4.x, 7.6.x for FTD).

Workarounds

• No vendor-documented workarounds eliminate the vulnerability; upgrading to fixed software is the supported remediation path per the Cisco advisory.
• Where immediate patching is not feasible, limit TLS-terminated services on affected devices to known client networks via interface ACLs to reduce exposure to unauthenticated network reachability.
• Consider temporarily constraining negotiated TLS 1.3 cipher suites on TLS proxy or termination layers in front of the firewall, where architecture allows, to avoid TLS_CHACHA20_POLY1305_SHA256 selection on Internet-facing paths.

# Example: restrict ASA HTTPS management access to a trusted subnet
http 10.10.0.0 255.255.255.0 management
no http 0.0.0.0 0.0.0.0 outside