Introduction
CVE-2025-20136 is a high-severity vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. An attacker can exploit it remotely and without authentication to cause a denial of service on critical network infrastructure. For organizations that rely on these devices, that means unexpected reloads and network outages with real consequences.
Cisco ASA and FTD are widely deployed in enterprise and service provider environments. They provide firewall, VPN, and advanced threat protection, and they form a backbone for secure network operations across industries.
Technical information
CVE-2025-20136 is a vulnerability in the function that performs IPv4 and IPv6 Network Address Translation (NAT) DNS inspection in Cisco Secure Firewall ASA and FTD software. The flaw is triggered when DNS inspection is enabled and the device is configured for NAT44, NAT64, or NAT46. An unauthenticated remote attacker can send specially crafted DNS packets that match a static NAT rule with DNS inspection enabled. The device enters an infinite loop while processing these packets and is forced to reload, which causes a denial of service.
The root cause is a loop with an unreachable exit condition (CWE-835) in the DNS inspection logic. DNS inspection is enabled by default on many ASA and FTD deployments. The attack needs no authentication or elevated privileges, which raises its risk. The flaw resembles earlier issues in Cisco's DNS inspection code, such as CVE-2022-20760, which also let crafted DNS requests cause a denial of service.
No code snippets or vulnerable code lines have been released publicly for this vulnerability. The attack itself is simple. An attacker sends crafted DNS packets through a NAT rule with DNS inspection enabled and triggers the infinite loop in the inspection engine.
Affected systems and versions
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
- Cisco Secure Firewall Threat Defense (FTD) Software
- Devices configured for NAT44, NAT64, or NAT46 with DNS inspection enabled
The public sources do not list specific affected version numbers as of the report date. A device is vulnerable when static NAT rules with DNS inspection are active.
Vendor security history
Cisco's firewall platforms have had similar vulnerabilities before, particularly in DNS inspection and NAT handling. Notable examples include:
- CVE-2024-20353: Web server denial of service in ASA and FTD (actively exploited)
- CVE-2022-20760: DNS inspection handler denial of service
- CVE-2024-20359: Persistent local code execution in ASA and FTD (actively exploited)
Cisco typically issues timely advisories and patches for critical vulnerabilities. Still, flaws keep recurring in its protocol inspection engines, which points to ongoing complexity and risk in these components.
