CVE-2025-20224: Cisco Secure Firewall IKEv2 DoS Vulnerability

CVE-2025-20224 Overview

CVE-2025-20224 is a memory leak vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can exploit improper IKEv2 packet parsing by sending a continuous stream of crafted packets. Successful exploitation partially exhausts system memory and prevents the device from establishing new IKEv2 VPN sessions. Recovery requires a manual device reboot. The flaw is tracked under [CWE-401] (Missing Release of Memory after Effective Lifetime).

Critical Impact

Remote unauthenticated attackers can degrade VPN availability on Cisco ASA and FTD devices, blocking new IKEv2 VPN sessions until administrators perform a manual reboot.

Affected Products

• Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
• Cisco Secure Firewall Threat Defense (FTD) Software
• Devices with the IKEv2 module enabled for remote-access or site-to-site VPN

Discovery Timeline

• 2025-08-14 - CVE-2025-20224 published to the National Vulnerability Database
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-20224

Vulnerability Analysis

The vulnerability resides in how the IKEv2 module parses incoming protocol packets on Cisco ASA and FTD Software. During parsing, allocated memory buffers are not released under specific conditions triggered by crafted packets. Each malformed packet leaks a small allocation. Sustained streams of these packets steadily consume the device's available memory.

As memory pressure increases, the IKEv2 subsystem can no longer satisfy allocation requests required to negotiate fresh VPN tunnels. Existing sessions may continue operating, but new IKEv2 negotiations fail. The device cannot self-recover through garbage collection or session timeout, so administrators must reboot the appliance to restore VPN service.

Root Cause

The root cause is a missing release of memory after effective lifetime [CWE-401] within IKEv2 packet processing. The parser allocates memory to handle specific IKEv2 message fields but fails to free that memory along an error or edge-case code path. Because the leak is reachable before authentication completes, attackers do not need valid credentials or an existing session.

Attack Vector

The attack vector is purely network-based. An attacker sends a continuous stream of crafted IKEv2 packets to UDP port 500 or 4500 on any interface where IKEv2 is accepted. No user interaction, authentication, or pre-existing tunnel is required. Refer to the Cisco Security Advisory for protocol-level technical details.

Detection Methods for CVE-2025-20224

Indicators of Compromise

• Sustained inbound UDP traffic to ports 500 and 4500 from unexpected source addresses
• Gradual decline in free system memory reported by show memory on the device
• Failed IKEv2 Phase 1 negotiations logged with allocation or resource errors
• Inability to establish new IKEv2 VPN sessions while existing tunnels remain active

Detection Strategies

• Monitor IKEv2 negotiation failure rates and correlate spikes with memory utilization trends on ASA and FTD devices
• Baseline normal IKEv2 traffic volumes and alert on sustained anomalous packet rates to UDP 500 and 4500
• Inspect syslog entries from the IKEv2 subsystem for repeated parsing errors or malformed packet messages

Monitoring Recommendations

• Forward ASA and FTD syslog, SNMP memory counters, and IKEv2 statistics into a centralized SIEM for correlation
• Configure alerts on free-memory thresholds dropping below operational baselines on VPN-facing appliances
• Track IKEv2 session establishment success rate as a service-health metric and alert on sudden degradation

How to Mitigate CVE-2025-20224

Immediate Actions Required

• Apply the fixed Cisco ASA or FTD software release referenced in the vendor advisory as soon as testing permits
• Restrict IKEv2 access at the network edge to known peer addresses where remote-access VPN scope allows it
• Reboot devices that exhibit memory exhaustion to restore IKEv2 VPN service

Patch Information

Cisco has published fixed software versions in the Cisco Security Advisory cisco-sa-asa-ftd-ios-dos-DOESHWHy. Administrators should consult the advisory's Fixed Software section, identify the corresponding train for their deployed image, and schedule an upgrade. No workarounds fully address the vulnerability according to the vendor.

Workarounds

• Apply control-plane access control lists to limit IKEv2 (UDP 500 and 4500) to trusted peer addresses for site-to-site VPNs
• Deploy upstream rate limiting or DDoS protection on UDP 500 and 4500 to slow exploitation attempts
• Establish an operational runbook to detect memory exhaustion early and perform controlled reboots until patching completes

# Example: restrict IKEv2 to known peers on Cisco ASA
access-list IKEV2_PEERS extended permit udp host 203.0.113.10 any eq isakmp
access-list IKEV2_PEERS extended permit udp host 203.0.113.10 any eq 4500
access-list IKEV2_PEERS extended deny udp any any eq isakmp
access-list IKEV2_PEERS extended deny udp any any eq 4500
access-group IKEV2_PEERS in interface outside