CVE-2025-20244: Cisco Secure Firewall DoS Vulnerability

CVE-2025-20244 Overview

CVE-2025-20244 is a denial of service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An authenticated VPN user can send a crafted HTTP request to force the affected device to reload unexpectedly. The flaw stems from incomplete error checking when parsing an HTTP header field value, classified as improper validation of specified type of input [CWE-1287]. Successful exploitation interrupts VPN connectivity and firewall services for all users behind the device.

Critical Impact

An authenticated remote attacker can trigger a full device reload on ASA and FTD appliances exposing Remote Access SSL VPN, causing outages for enterprise perimeter and remote workforce connectivity.

Affected Products

• Cisco Secure Firewall Adaptive Security Appliance (ASA) Software with Remote Access SSL VPN enabled
• Cisco Secure Firewall Threat Defense (FTD) Software with Remote Access SSL VPN enabled
• Refer to the Cisco Security Advisory for the complete list of affected releases

Discovery Timeline

• 2025-08-14 - CVE-2025-20244 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-20244

Vulnerability Analysis

The vulnerability resides in the HTTP request handling logic of the Remote Access SSL VPN service on Cisco ASA and FTD. When the service parses a specific HTTP header field value, it fails to fully validate error conditions returned during parsing. A malformed value reaches downstream processing in an unexpected state and triggers an unrecoverable fault. The device responds by reloading, which terminates every active VPN tunnel and disrupts traffic inspection for the duration of the reboot.

Exploitation requires the attacker to first authenticate as a valid VPN user. Once authenticated, the attacker submits a crafted HTTP request to the VPN web service. The condition is reachable over the network without user interaction. Because the scope is changed, a single authenticated session can impact availability for all users sharing the device.

Root Cause

The root cause is incomplete error checking when parsing an HTTP header field value within the Remote Access SSL VPN web service. The code path accepts header content that the parser cannot fully validate, leading to a process crash and full system reload rather than a contained error response. This maps to CWE-1287, improper validation of specified type of input to a function.

Attack Vector

The attack is delivered over the network to a publicly reachable Remote Access SSL VPN endpoint. The attacker authenticates with valid VPN credentials, then issues a single crafted HTTP request containing the malformed header value. No additional privileges or user interaction are required. Cisco has not reported active exploitation, and no public proof-of-concept code is available at the time of writing.

No verified exploit code is available. Refer to the Cisco Security Advisory
for technical details on the vulnerable HTTP header parsing path.

Detection Methods for CVE-2025-20244

Indicators of Compromise

• Unexpected reloads of ASA or FTD devices with crash files referencing the WebVPN or SSL VPN process
• Repeated VPN authentication events from a single user immediately followed by device reboot events in syslog
• Gaps in NetFlow or VPN session accounting that align with unscheduled appliance restarts

Detection Strategies

• Monitor ASA and FTD syslog for reload messages such as %ASA-1-199020 traceback events tied to the WebVPN process
• Correlate VPN authentication logs with subsequent device unavailability to identify the user account used during a crash
• Alert on abnormal HTTP request patterns to the VPN web interface, including oversized or malformed header values

Monitoring Recommendations

• Forward ASA and FTD syslog, SNMP traps, and crashinfo files to a centralized logging or SIEM platform for retention and correlation
• Track device uptime as a continuous metric and alert when uptime resets outside maintenance windows
• Review VPN account activity for low-trust or service accounts that authenticate from unexpected geolocations

How to Mitigate CVE-2025-20244

Immediate Actions Required

• Apply the fixed Cisco ASA or FTD software release identified in the Cisco Security Advisory for your platform
• Audit Remote Access SSL VPN user accounts and disable or rotate credentials for inactive, shared, or low-trust accounts
• Enforce multi-factor authentication on all Remote Access SSL VPN logins to raise the barrier for credential abuse
• Restrict management and VPN access to known source ranges where business requirements allow

Patch Information

Cisco has released software updates that address this vulnerability. Refer to the Cisco Security Advisory cisco-sa-asaftd-vpnwebs-dos-hjBhmBsX for the fixed release matrix that maps each affected ASA and FTD train to its remediated version. No workarounds are listed by the vendor, so upgrading is the required remediation path.

Workarounds

• No vendor-supplied workarounds are available; upgrading to a fixed release is required
• As a compensating control, terminate Remote Access SSL VPN on a high-availability pair so a single reload fails over rather than disconnecting all users
• Increase monitoring of VPN authentication and device availability until patches are deployed

# Verify the running ASA or FTD software version against the Cisco fixed release matrix
show version | include Software
show running-config webvpn