A vulnerability in the certificate processing of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper parsing of SSL/TLS certificates. An attacker could exploit this vulnerability by sending crafted DNS packets that match a static Network Address Translation (NAT) rule with DNS inspection enabled through an affected device.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.6 | CVE-2025-20134 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted DNS packets that align with a static NAT rule on a device with DNS inspection enabled. This can lead to improper parsing of SSL/TLS certificates, causing the device to reload and resulting in a denial of service.
Affected Products
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software: A firewall solution that provides advanced threat protection.
- Cisco Secure Firewall Threat Defense (FTD) Software: A unified software solution that integrates firewall and threat defense capabilities.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security patches provided by Cisco for the affected products. Additionally, monitoring network traffic for unusual DNS activity and implementing strict access controls can help reduce the risk of exploitation.