Cisco ASA and FTD CVE-2025-20134: Brief Summary of SSL/TLS Certificate Double Free DoS Vulnerability

Introduction

Unexpected reloads of critical perimeter firewalls can disrupt VPN access, remote work, and even core business operations. CVE-2025-20134 is a high-severity vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Flaws in how the software parses SSL/TLS certificates let an unauthenticated, remote attacker cause a denial of service.

Cisco ASA and FTD are security appliances widely deployed in enterprise and service provider networks. They provide firewall, VPN, and advanced threat defense capabilities, and many organizations depend on their reliability and security at the network perimeter.

Technical information

CVE-2025-20134 comes from improper parsing of SSL/TLS certificates in Cisco ASA and FTD software. It is categorized as CWE-415 (double free), a flaw in which the same memory block is released more than once. Here, the SSL/TLS certificate validation logic fails to manage memory correctly when it handles certain malformed or crafted certificates.

An unauthenticated attacker can exploit this by sending a specially crafted SSL/TLS certificate to any listening SSL/TLS socket on a vulnerable device, for example through AnyConnect VPN, Clientless SSL VPN, or another SSL/TLS-enabled interface. When the device processes the malicious certificate, its memory management routines may attempt to free the same memory region twice. If that happens, memory is corrupted and the device reloads immediately. The result is a denial of service, and all network traffic through the affected firewall is disrupted until the device comes back.

The attack needs no authentication, and any exposed SSL/TLS service is a potential target. No public code snippets or proof-of-concept exploits are available for this vulnerability. Only specific versions of ASA and FTD software are affected, as listed below.

Patch information

Cisco has released software updates for the SSL/TLS Denial of Service vulnerability in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. The updates fix the improper processing of incoming SSL/TLS packets that allowed unauthenticated, remote attackers to make affected devices reload unexpectedly, causing a denial of service (DoS) condition.

Fixed software releases:

For Cisco ASA Software:

• 9.8: Fixed in 9.8.4.40
• 9.12: Fixed in 9.12.4.26
• 9.14: Fixed in 9.14.3.9
• 9.15: Fixed in 9.15.1.17
• 9.16: Not vulnerable

For Cisco FTD Software:

• 6.2.3: Fixed in 6.2.3.17
• 6.4.0: Fixed in 6.4.0.13 (Nov 2021)
• 6.6.0: Fixed in 6.6.5
• 6.7.0: Fixed in 6.7.0.3 (Jan 2022)
• 7.0.0: Not vulnerable

Upgrade recommendations:

1. Run the show version command to find the software version your device is running.
2. Review your configuration for AnyConnect IKEv2 Remote Access, AnyConnect SSL VPN, or Clientless SSL VPN. These are the features relevant to the vulnerability.
3. Schedule the upgrade during a maintenance window to minimize impact, and back up the current configuration before you start.
4. Get the appropriate fixed release from the Cisco Software Download Center. Then follow the upgrade procedure in the Cisco ASA Upgrade Guide or the Cisco Firepower Management Center Upgrade Guide, depending on your device.
5. After the upgrade, check the software version to confirm the update, and watch the system logs to confirm normal operation.

Applying these updates promptly reduces the risk from this vulnerability.

The full details are in the official Cisco Security Advisory, Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Denial of Service Vulnerability.

Affected systems and versions

Cisco ASA Software:

• 9.8 (prior to 9.8.4.40)
• 9.12 (prior to 9.12.4.26)
• 9.14 (prior to 9.14.3.9)
• 9.15 (prior to 9.15.1.17)
• 9.16: Not vulnerable

Cisco FTD Software:

• 6.2.3 (prior to 6.2.3.17)
• 6.4.0 (prior to 6.4.0.13)
• 6.6.0 (prior to 6.6.5)
• 6.7.0 (prior to 6.7.0.3)
• 7.0.0: Not vulnerable

Vulnerable configurations: Devices with AnyConnect IKEv2 Remote Access, AnyConnect SSL VPN, or Clientless SSL VPN features enabled and listening for SSL/TLS connections.

Vendor security history

Cisco has a history of SSL/TLS-related vulnerabilities in ASA and FTD products, often involving memory management or cryptographic processing errors. Previous advisories have addressed similar issues, including improper input validation and memory handling in SSL/TLS packet processing. Cisco typically responds with timely advisories and detailed patch guidance. Still, the same kinds of flaws keep recurring, which shows that implementing secure protocols in complex network devices remains hard.

References

• NVD entry for CVE-2025-20134
• MITRE CVE entry
• Cisco Security Advisory: SSL/TLS Certificate DoS
• Cisco Security Advisory: Fixed Software
• OWASP: Doubly freeing memory