PT-2025-33321 · Cisco · Cisco Secure Firewall Threat Defense (Ftd)+2

Published 2025-08-14 · Updated 2025-10-14 · CVE-2025-20222

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software (affected versions not specified)

Description: A vulnerability in the RADIUS proxy feature of the IPsec VPN functionality can allow a remote, unauthenticated attacker to cause a denial of service (DoS) condition. This issue is due to improper processing of IPv6 packets. An attacker could exploit this by sending IPv6 packets over an IPsec VPN connection to an affected device, potentially triggering a reload and resulting in a DoS condition.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2025-10342

CVE-2025-20222

Affected Products

Cisco Asa

Cisco Secure Firewall Asa

Cisco Secure Firewall Threat Defense (Ftd)

References · 8

• https://bdu.fstec.ru/vul/2025-10342 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fp2k-IPsec-dos-tjwgdZCO · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20222 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/724301 · Security Note
• https://twitter.com/CveFindCom/status/1956041148939600307 · Twitter Post
• https://twitter.com/CVEnew/status/1956390336541941888 · Twitter Post
• https://t.me/true_secator/7332 · Telegram Post
• https://twitter.com/0dayPublishing/status/1956045524584247561 · Twitter Post