CVE-2025-20225: Cisco IKEv2 DoS Vulnerability

CVE-2025-20225 Overview

CVE-2025-20225 is a memory leak vulnerability [CWE-401] in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive Security Appliance (ASA) Software, and Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can send crafted IKEv2 packets to trigger a denial of service (DoS) condition. On Cisco IOS and IOS XE devices, exploitation causes an unexpected device reload. On Cisco ASA and FTD devices, exploitation partially exhausts system memory, preventing new IKEv2 VPN session establishment until a manual reboot.

Critical Impact

Remote unauthenticated attackers can disrupt VPN services and force device reloads on Cisco networking and firewall infrastructure.

Affected Products

• Cisco IOS Software
• Cisco IOS XE Software
• Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software

Discovery Timeline

• 2025-08-14 - CVE-2025-20225 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-20225

Vulnerability Analysis

The vulnerability resides in the IKEv2 packet processing path of multiple Cisco software platforms. IKEv2 is the protocol used to establish IPsec VPN security associations. Improper handling of specific IKEv2 packet structures causes the affected device to allocate memory that is never released, producing a steady memory leak [CWE-401].

The behavior diverges by platform. On Cisco IOS and IOS XE Software, sustained exploitation drives the device into an unexpected reload. On Cisco ASA and FTD Software, the leak partially exhausts available memory, leaving the device running but unable to negotiate new IKEv2 VPN sessions. Recovery requires a manual reboot in both cases.

The attack requires no authentication or user interaction and originates over the network. EPSS data indicates a probability of 0.136% (percentile 33.004) as of the latest scoring.

Root Cause

The root cause is a lack of proper processing of IKEv2 packets in the affected codebase. Memory allocated during IKEv2 message handling is not consistently freed when malformed or specifically crafted packets are received. Repeated exposure to such packets accumulates leaked memory in the IKEv2 subsystem.

Attack Vector

An attacker reaches the vulnerable code by sending crafted IKEv2 packets to UDP port 500 or 4500 on any interface where IKEv2 is enabled. Devices terminating IPsec VPN tunnels are typically exposed to untrusted networks, making the attack surface broad. No credentials, no existing tunnel, and no user interaction are required.

No public proof-of-concept exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Cisco Security Advisory for the authoritative technical description.

Detection Methods for CVE-2025-20225

Indicators of Compromise

• Steady, unexplained growth in memory utilization on devices with IKEv2 enabled, with no corresponding increase in legitimate VPN session counts.
• Unexpected device reloads on Cisco IOS or IOS XE platforms with crash records referencing IKEv2 processes.
• Failures to establish new IKEv2 VPN sessions on ASA or FTD devices while existing sessions remain active.
• Elevated volume of malformed or anomalous IKEv2 packets directed at UDP 500 or UDP 4500.

Detection Strategies

• Monitor show memory and show processes memory output on Cisco IOS/IOS XE for growth in IKEv2-related allocations.
• On ASA/FTD, monitor show memory detail and free memory trends correlated with IKEv2 traffic volume.
• Inspect IKEv2 negotiation logs for repeated failures from the same source addresses.
• Use NetFlow or firewall logs to identify high-frequency or malformed IKEv2 traffic sources.

Monitoring Recommendations

• Configure SNMP traps and syslog alerts for memory thresholds and unplanned reloads on affected devices.
• Forward Cisco device telemetry to a centralized SIEM and correlate memory anomalies with IKEv2 traffic spikes.
• Baseline normal IKEv2 negotiation rates per peer and alert on deviations.

How to Mitigate CVE-2025-20225

Immediate Actions Required

• Apply the fixed software releases listed in the Cisco Security Advisory for IOS, IOS XE, ASA, and FTD.
• Inventory all devices with IKEv2 enabled and prioritize internet-facing VPN concentrators.
• Restrict IKEv2 access using access control lists to known VPN peer addresses where feasible.
• Schedule maintenance windows to reboot devices that may already be in a degraded memory state.

Patch Information

Cisco has published fixed software versions in its security advisory. Administrators should consult the Cisco Security Advisory to identify the appropriate fixed release for each affected platform and deployment, and upgrade according to Cisco's recommended upgrade path.

Workarounds

• No workaround fully addresses the underlying memory leak; Cisco recommends upgrading to a fixed release.
• Where patching is delayed, apply infrastructure access control lists to limit IKEv2 traffic to trusted peer IP ranges.
• Disable IKEv2 on interfaces that do not require it to reduce the exposed attack surface.

# Example: restrict IKEv2 (UDP 500 and 4500) to trusted VPN peers on Cisco IOS/IOS XE
ip access-list extended IKEV2-FILTER
 permit udp host <trusted_peer_ip> any eq 500
 permit udp host <trusted_peer_ip> any eq 4500
 deny   udp any any eq 500 log
 deny   udp any any eq 4500 log
 permit ip any any
!
interface GigabitEthernet0/0
 ip access-group IKEV2-FILTER in