Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.8

Cisco ASA and FTD Software May Crash if Sent Fake IKEv2 Packets

CVE-2025-20224 · published 1 year ago
Summary

If an attacker sends fake VPN connection requests to a Cisco ASA or FTD device, it may run out of memory and shut down, requiring a reboot to fix. This could happen if the device is not properly configured or if an attacker is intentionally trying to disrupt it. Cisco has not yet released a fix, so users should consider workarounds like limiting the number of incoming VPN connections.

Original advisory text
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could all...
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition.

This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to partially exhaust system memory, causing system instability like being unable to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-401Memory Leak
Timeline
Published14 Aug 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-20224 · NVD
Track software like this
Free during beta