Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense…
Priority LOW 34CWE-1287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow a remote attacker that is authenticated as a VPN user to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header field value. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause a DoS condition, which would cause the affected device to reload.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00553 46th percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Adaptive Security Appliance (ASA) Software | 9.12.3; 9.8.3; 9.12.1; 9.8.1; 9.12.2; 9.8.2.45; 9.8.2; 9.8.4; 9.14.1; 9.12.4; 9.8.2.26; 9.8.2.24; 9.8.2.15; 9.8.2.14; 9.8.2.35; 9.8.2.20; 9.8.2.8; 9.8.2.17; 9.8.2.28; 9.8.2.33; 9.8.2.38; 9.8.4.25; 9.12.3.2; 9.12.3.7; 9.8.3.18; 9.8.3.14; 9.8.4.15; 9.8.4.8; 9.8.1.7; 9.8.3.29; 9.14.1.10; 9.12.2.5; 9.8.4.22; 9.12.3.12; 9.8.4.7; 9.8.4.17; 9.8.3.16; 9.8.4.20; 9.8.3.11; 9.12.1.3; 9.8.4.3; 9.12.2.4; 9.8.4.12; 9.12.1.2; 9.8.3.26; 9.8.1.5; 9.12.2.9; 9.12.3.9; 9.8.3.21; 9.8.4.10; 9.12.2.1; 9.12.4.2; 9.14.1.6; 9.8.3.8; 9.14.1.15; 9.14.1.19; 9.8.4.26; 9.12.4.4; 9.14.1.30; 9.8.4.29; 9.12.4.7; 9.14.2; 9.12.4.8; 9.8.4.32; 9.12.4.10; 9.14.2.4; 9.14.2.8; 9.12.4.13; 9.8.4.33; 9.14.2.13; 9.8.4.34; 9.12.4.18; 9.8.4.35; 9.14.2.15; 9.12.4.24; 9.16.1; 9.8.4.39; 9.14.3; 9.12.4.26; 9.16.1.28; 9.14.3.1; 9.12.4.29; 9.14.3.9; 9.16.2; 9.12.4.30; 9.16.2.3; 9.8.4.40; 9.14.3.11; 9.12.4.35; 9.8.4.41; 9.14.3.13; 9.16.2.7; 9.12.4.37; 9.14.3.15; 9.17.1; 9.16.2.11; 9.14.3.18; 9.16.2.13; 9.12.4.39; 9.12.4.38; 9.8.4.43; 9.14.4; 9.16.2.14; 9.17.1.7; 9.12.4.40; 9.16.3.3; 9.14.4.6; 9.16.3; 9.16.3.14; 9.17.1.9; 9.14.4.7; 9.12.4.41; 9.17.1.10; 9.8.4.44; 9.18.1; 9.12.4.47; 9.14.4.12; 9.16.3.15; 9.18.1.3; 9.17.1.11; 9.12.4.48; 9.14.4.13; 9.18.2; 9.16.3.19; 9.17.1.13; 9.12.4.50; 9.14.4.14; 9.17.1.15; 9.8.4.45; 9.12.4.52; 9.14.4.15; 9.16.3.23; 9.18.2.5; 9.16.4; 9.12.4.54; 9.14.4.17; 9.8.4.46; 9.17.1.20; 9.18.2.7; 9.19.1; 9.16.4.9; 9.12.4.55; 9.18.2.8; 9.14.4.22; 9.16.4.14; 9.8.4.48; 9.18.3; 9.19.1.5; 9.14.4.23; 9.12.4.56; 9.16.4.18; 9.17.1.30; 9.19.1.9; 9.18.3.39; 9.16.4.19; 9.12.4.58; 9.19.1.12; 9.18.3.46; 9.16.4.27; 9.19.1.18; 9.18.3.53; 9.18.3.55; 9.16.4.38; 9.17.1.33; 9.12.4.62; 9.16.4.39; 9.18.3.56; 9.20.1; 9.16.4.42; 9.19.1.22; 9.18.4; 9.20.1.5; 9.18.4.5; 9.19.1.24; 9.16.4.48; 9.18.4.8; 9.20.2; 9.19.1.27; 9.12.4.65; 9.16.4.55; 9.18.4.22; 9.20.2.10; 9.16.4.57; 9.19.1.28; 9.17.1.39; 9.12.4.67; 9.14.4.24; 9.18.4.24; 9.20.2.21; 9.16.4.61; 9.19.1.31; 9.18.4.29; 9.20.2.22; 9.16.4.62; 9.18.4.34; 9.20.3; 9.16.4.67; 9.16.4.70; 9.18.4.40; 9.22.1.1; 9.16.4.71; 9.20.3.4; 9.16.4.76; 9.22.1.2; 9.16.4.82 | — | No fix listed | CNA |
| Cisco | Cisco Firepower Threat Defense Software | 6.2.3.14; 6.4.0.1; 6.2.3.7; 6.2.3; 6.4.0.2; 6.2.3.9; 6.2.3.1; 6.2.3.2; 6.4.0.5; 6.2.3.10; 6.4.0; 6.4.0.3; 6.2.3.6; 6.4.0.4; 6.2.3.15; 6.2.3.5; 6.2.3.4; 6.2.3.3; 6.2.3.8; 6.4.0.6; 6.2.3.11; 6.2.3.12; 6.2.3.13; 6.4.0.7; 6.4.0.8; 6.6.0; 6.4.0.9; 6.2.3.16; 6.6.0.1; 6.6.1; 6.4.0.10; 6.4.0.11; 6.6.3; 6.6.4; 6.4.0.12; 7.0.0; 6.2.3.17; 7.0.0.1; 6.6.5; 7.0.1; 7.1.0; 6.4.0.13; 6.6.5.1; 6.2.3.18; 7.0.1.1; 6.4.0.14; 7.1.0.1; 6.6.5.2; 7.0.2; 6.4.0.15; 7.2.0; 7.0.2.1; 7.0.3; 6.6.7; 7.1.0.2; 7.2.0.1; 7.0.4; 7.2.1; 7.0.5; 6.4.0.16; 7.3.0; 7.2.2; 7.2.3; 6.6.7.1; 7.3.1; 7.1.0.3; 7.2.4; 7.0.6; 7.2.5; 7.2.4.1; 7.3.1.1; 7.4.0; 6.4.0.17; 7.0.6.1; 7.2.5.1; 7.4.1; 7.2.6; 7.0.6.2; 7.4.1.1; 6.6.7.2; 6.4.0.18; 7.2.7; 7.2.5.2; 7.3.1.2; 7.2.8; 7.6.0; 7.4.2; 7.2.8.1; 7.0.6.3; 7.4.2.1; 7.0.7; 7.4.2.2; 7.4.2.3 | — | No fix listed | CNA |
- Cisco Adaptive Security Appliance (ASA) Software VendorCisco Affected 9.12.3; 9.8.3; 9.12.1; 9.8.1; 9.12.2; 9.8.2.45; 9.8.2; 9.8.4; 9.14.1; 9.12.4; 9.8.2.26; 9.8.2.24; 9.8.2.15; 9.8.2.14; 9.8.2.35; 9.8.2.20; 9.8.2.8; 9.8.2.17; 9.8.2.28; 9.8.2.33; 9.8.2.38; 9.8.4.25; 9.12.3.2; 9.12.3.7; 9.8.3.18; 9.8.3.14; 9.8.4.15; 9.8.4.8; 9.8.1.7; 9.8.3.29; 9.14.1.10; 9.12.2.5; 9.8.4.22; 9.12.3.12; 9.8.4.7; 9.8.4.17; 9.8.3.16; 9.8.4.20; 9.8.3.11; 9.12.1.3; 9.8.4.3; 9.12.2.4; 9.8.4.12; 9.12.1.2; 9.8.3.26; 9.8.1.5; 9.12.2.9; 9.12.3.9; 9.8.3.21; 9.8.4.10; 9.12.2.1; 9.12.4.2; 9.14.1.6; 9.8.3.8; 9.14.1.15; 9.14.1.19; 9.8.4.26; 9.12.4.4; 9.14.1.30; 9.8.4.29; 9.12.4.7; 9.14.2; 9.12.4.8; 9.8.4.32; 9.12.4.10; 9.14.2.4; 9.14.2.8; 9.12.4.13; 9.8.4.33; 9.14.2.13; 9.8.4.34; 9.12.4.18; 9.8.4.35; 9.14.2.15; 9.12.4.24; 9.16.1; 9.8.4.39; 9.14.3; 9.12.4.26; 9.16.1.28; 9.14.3.1; 9.12.4.29; 9.14.3.9; 9.16.2; 9.12.4.30; 9.16.2.3; 9.8.4.40; 9.14.3.11; 9.12.4.35; 9.8.4.41; 9.14.3.13; 9.16.2.7; 9.12.4.37; 9.14.3.15; 9.17.1; 9.16.2.11; 9.14.3.18; 9.16.2.13; 9.12.4.39; 9.12.4.38; 9.8.4.43; 9.14.4; 9.16.2.14; 9.17.1.7; 9.12.4.40; 9.16.3.3; 9.14.4.6; 9.16.3; 9.16.3.14; 9.17.1.9; 9.14.4.7; 9.12.4.41; 9.17.1.10; 9.8.4.44; 9.18.1; 9.12.4.47; 9.14.4.12; 9.16.3.15; 9.18.1.3; 9.17.1.11; 9.12.4.48; 9.14.4.13; 9.18.2; 9.16.3.19; 9.17.1.13; 9.12.4.50; 9.14.4.14; 9.17.1.15; 9.8.4.45; 9.12.4.52; 9.14.4.15; 9.16.3.23; 9.18.2.5; 9.16.4; 9.12.4.54; 9.14.4.17; 9.8.4.46; 9.17.1.20; 9.18.2.7; 9.19.1; 9.16.4.9; 9.12.4.55; 9.18.2.8; 9.14.4.22; 9.16.4.14; 9.8.4.48; 9.18.3; 9.19.1.5; 9.14.4.23; 9.12.4.56; 9.16.4.18; 9.17.1.30; 9.19.1.9; 9.18.3.39; 9.16.4.19; 9.12.4.58; 9.19.1.12; 9.18.3.46; 9.16.4.27; 9.19.1.18; 9.18.3.53; 9.18.3.55; 9.16.4.38; 9.17.1.33; 9.12.4.62; 9.16.4.39; 9.18.3.56; 9.20.1; 9.16.4.42; 9.19.1.22; 9.18.4; 9.20.1.5; 9.18.4.5; 9.19.1.24; 9.16.4.48; 9.18.4.8; 9.20.2; 9.19.1.27; 9.12.4.65; 9.16.4.55; 9.18.4.22; 9.20.2.10; 9.16.4.57; 9.19.1.28; 9.17.1.39; 9.12.4.67; 9.14.4.24; 9.18.4.24; 9.20.2.21; 9.16.4.61; 9.19.1.31; 9.18.4.29; 9.20.2.22; 9.16.4.62; 9.18.4.34; 9.20.3; 9.16.4.67; 9.16.4.70; 9.18.4.40; 9.22.1.1; 9.16.4.71; 9.20.3.4; 9.16.4.76; 9.22.1.2; 9.16.4.82 Fixed in — No fix listed CNA
- Cisco Firepower Threat Defense Software VendorCisco Affected 6.2.3.14; 6.4.0.1; 6.2.3.7; 6.2.3; 6.4.0.2; 6.2.3.9; 6.2.3.1; 6.2.3.2; 6.4.0.5; 6.2.3.10; 6.4.0; 6.4.0.3; 6.2.3.6; 6.4.0.4; 6.2.3.15; 6.2.3.5; 6.2.3.4; 6.2.3.3; 6.2.3.8; 6.4.0.6; 6.2.3.11; 6.2.3.12; 6.2.3.13; 6.4.0.7; 6.4.0.8; 6.6.0; 6.4.0.9; 6.2.3.16; 6.6.0.1; 6.6.1; 6.4.0.10; 6.4.0.11; 6.6.3; 6.6.4; 6.4.0.12; 7.0.0; 6.2.3.17; 7.0.0.1; 6.6.5; 7.0.1; 7.1.0; 6.4.0.13; 6.6.5.1; 6.2.3.18; 7.0.1.1; 6.4.0.14; 7.1.0.1; 6.6.5.2; 7.0.2; 6.4.0.15; 7.2.0; 7.0.2.1; 7.0.3; 6.6.7; 7.1.0.2; 7.2.0.1; 7.0.4; 7.2.1; 7.0.5; 6.4.0.16; 7.3.0; 7.2.2; 7.2.3; 6.6.7.1; 7.3.1; 7.1.0.3; 7.2.4; 7.0.6; 7.2.5; 7.2.4.1; 7.3.1.1; 7.4.0; 6.4.0.17; 7.0.6.1; 7.2.5.1; 7.4.1; 7.2.6; 7.0.6.2; 7.4.1.1; 6.6.7.2; 6.4.0.18; 7.2.7; 7.2.5.2; 7.3.1.2; 7.2.8; 7.6.0; 7.4.2; 7.2.8.1; 7.0.6.3; 7.4.2.1; 7.0.7; 7.4.2.2; 7.4.2.3 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-20244
- 2026-10-03 Alias added: GHSA-jj2c-3m89-73r8
References
More Cisco vulnerabilities
- TI-2026-74174 Arbitrary file write in Cisco Secure Email Gateway via AMP feature KEVCVSS 3.1CRITICAL 9.8
- TI-2026-53490 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-53489 Cisco Secure Email Gateway SQL Injection Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-53488 Cisco Identity Services Engine Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2026-16388 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2026-16344 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2025-20244 · CVE Program
- CVE-2025-20244 · NVD
- FIRST EPSS
- GHSA-jj2c-3m89-73r8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences