Introduction
A single crafted IPv6 packet can force a critical Cisco firewall offline and cut VPN connectivity for thousands of users. That is the impact of CVE-2025-20222, a high-severity denial of service flaw in Cisco's Secure Firewall ASA and FTD appliances. Enterprises and governments rely on these devices for network security, and they protect remote access and site-to-site VPNs around the world.
Technical Information
CVE-2025-20222 is a buffer overflow vulnerability (CWE-120) in the RADIUS proxy feature for IPsec VPN within Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. Improper processing of IPv6 packets triggers it. An unauthenticated remote attacker can send specially crafted IPv6 packets over an IPsec VPN connection to the affected device. When the RADIUS proxy logic processes these packets, insufficient bounds checking allows memory corruption. The device then reloads, which causes the denial of service.
Cisco has not disclosed public code snippets or detailed protocol traces. The vulnerability affects the IPv6 packet handling routines in the RADIUS proxy code path when that path is used with IPsec VPN. The flaw does not require authentication, so any attacker who can send traffic through an established IPsec tunnel can reach it.
Affected Systems and Versions
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software: versions with RADIUS proxy enabled for IPsec VPN and IPv6 processing
- Cisco Secure Firewall Threat Defense (FTD) Software: versions with RADIUS proxy enabled for IPsec VPN and IPv6 processing
Only devices configured to use the RADIUS proxy feature for IPsec VPN with IPv6 traffic are vulnerable. The advisory does not specify exact version numbers, but the vulnerability is present in currently supported releases as of August 2025. See the Cisco advisory for updates.
Vendor Security History
Cisco ASA and FTD platforms have had several high-severity vulnerabilities in recent years, including:
- CVE-2024-20481: Remote Access VPN DoS, actively exploited
- CVE-2024-20353: Web services DoS, CVSS 8.6
- Multiple buffer overflow and protocol parsing issues (CWE-120)
Cisco usually issues advisories and patches quickly, but how often critical flaws turn up in these products is a recurring concern for enterprise defenders.
