Cisco ASA/Firepower Threat Defense SSL VPN Service improper validation of specified type of input

Summaryinfo

A vulnerability labeled as critical has been found in Cisco ASA and Firepower Threat Defense. Affected is an unknown function of the component SSL VPN Service. Executing a manipulation can lead to improper validation of specified type of input. This vulnerability is handled as CVE-2025-20251. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in Cisco ASA and Firepower Threat Defense (the affected version unknown). This vulnerability affects an unknown part of the component SSL VPN Service. The manipulation with an unknown input leads to a improper validation of specified type of input vulnerability. The CWE definition for the vulnerability is CWE-1287. The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to create or delete arbitrary files on the underlying operating system. If critical system files are manipulated, new Remote Access SSL VPN sessions could be denied and existing sessions could be dropped, causing a denial of service (DoS) condition. An exploited device requires a manual reboot to recover. This vulnerability is due to insufficient input validation when processing HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to create or delete files on the underlying operating system, which could cause the Remote Access SSL VPN service to become unresponsive. To exploit this vulnerability, the attacker must be authenticated as a VPN user of the affected device.

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability was named CVE-2025-20251 since 10/10/2024. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/17/2025).

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-1839). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Cisco ASA (Adaptive Security Appliance)

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• ASA
• Firepower Threat Defense

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion