Introduction
Disruptions to remote access VPN services can halt business operations and cut critical infrastructure off from remote management. CVE-2025-20251 is a newly disclosed vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. It lets authenticated VPN users create or delete arbitrary files on the device's underlying operating system. If attackers target critical system files, the Remote Access SSL VPN service may become unresponsive. The result is a denial of service, and recovery requires a manual reboot.
Cisco is a dominant vendor in enterprise network security. ASA and FTD are deployed globally across government, finance, healthcare, and critical infrastructure, and thousands of organizations depend on these appliances for remote access and perimeter defense.
Technical Information
CVE-2025-20251 is caused by insufficient input validation in the Remote Access SSL VPN service of Cisco ASA and FTD. When the software processes HTTP requests from authenticated VPN users, it does not properly validate input parameters that it later uses in file operations. An attacker with valid VPN credentials can send crafted HTTP requests that can create or delete arbitrary files on the device's underlying OS. The vulnerability is classified as CWE-1287 (Improper Validation of Specified Type of Input).
If an attacker manipulates or deletes critical system files, the VPN service can become unresponsive, dropping existing sessions and refusing new connections. The only way to recover is a manual reboot of the affected device. Exploitation needs no privileges beyond VPN user authentication, so any compromised or malicious VPN user account can carry it out.
No public code snippets or proof of concept have been released for this issue.
Patch Information
Cisco has released software updates for both ASA and FTD that improve input validation in HTTP request processing. Administrators should upgrade affected devices to the fixed software versions listed in the official Cisco Security Advisory:
Once patched, the device performs only authorized file operations, which reduces the risk of service disruption.
Affected Systems and Versions
- Cisco Adaptive Security Appliance (ASA) Software: all versions supporting Remote Access SSL VPN before the fixed release (see the Cisco advisory for exact version numbers)
- Cisco Firepower Threat Defense (FTD) Software: all versions supporting Remote Access SSL VPN before the fixed release (see the Cisco advisory for exact version numbers)
- Only devices with Remote Access SSL VPN enabled are vulnerable
The Cisco advisory has detailed version and configuration information.
Vendor Security History
Cisco ASA and FTD have had similar vulnerabilities before. Notable examples include:
- CVE-2024-20353 and CVE-2024-20359, both exploited in the ArcaneDoor campaign
- CVE-2020-3452, a directory traversal vulnerability in ASA and FTD web services
Cisco typically issues advisories and patches quickly, but the recurring input validation flaws indicate continuing problems with secure development in its web and VPN components.
