Description
A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Cisco Firepower 3100 and 4200 Series devices could allow an authenticated, remote attacker to consume resources that are associated with incoming TLS 1.3 connections, which eventually could cause the device to stop accepting any new SSL/TLS or VPN requests.

This vulnerability is due to the implementation of the TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. An attacker could exploit this vulnerability by sending a large number of TLS 1.3 connections with the specific TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. A successful exploit could allow the attacker to cause a denial of service (DoS) condition where no new incoming encrypted connections are accepted. The device must be reloaded to clear this condition.
Note: These incoming TLS 1.3 connections include both data traffic and user-management traffic. After the device is in the vulnerable state, no new encrypted connections can be accepted.
Published: 2025-08-14
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-24854 A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Cisco Firepower 3100 and 4200 Series devices could allow an authenticated, remote attacker to consume resources that are associated with incoming TLS 1.3 connections, which eventually could cause the device to stop accepting any new SSL/TLS or VPN requests. This vulnerability is due to the implementation of the TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. An attacker could exploit this vulnerability by sending a large number of TLS 1.3 connections with the specific TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. A successful exploit could allow the attacker to cause a denial of service (DoS) condition where no new incoming encrypted connections are accepted. The device must be reloaded to clear this condition. Note: These incoming TLS 1.3 connections include both data traffic and user-management traffic. After the device is in the vulnerable state, no new encrypted connections can be accepted.
History

Mon, 25 Aug 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Cisco firepower Threat Defense
Cisco secure Firewall 3105
Cisco secure Firewall 3110
Cisco secure Firewall 3120
Cisco secure Firewall 3130
Cisco secure Firewall 3140
Cisco secure Firewall 4215
Cisco secure Firewall 4225
Cisco secure Firewall 4245
CPEs cpe:2.3:a:cisco:firepower_threat_defense:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:7.4.1.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:7.4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:7.6.0:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_firewall_3105:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_firewall_3110:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_firewall_3120:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_firewall_3130:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_firewall_3140:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_firewall_4215:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_firewall_4225:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:secure_firewall_4245:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.1.5:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.2.10:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.2.21:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.2.22:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.2:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.3.4:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.3.7:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:9.20.3:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:9.22.1.1:*:*:*:*:*:*:*
Vendors & Products Cisco firepower Threat Defense
Cisco secure Firewall 3105
Cisco secure Firewall 3110
Cisco secure Firewall 3120
Cisco secure Firewall 3130
Cisco secure Firewall 3140
Cisco secure Firewall 4215
Cisco secure Firewall 4225
Cisco secure Firewall 4245

Sat, 16 Aug 2025 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Cisco
Cisco adaptive Security Appliance Software
Cisco firepower Threat Defense Software
Vendors & Products Cisco
Cisco adaptive Security Appliance Software
Cisco firepower Threat Defense Software

Thu, 14 Aug 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 14 Aug 2025 16:45:00 +0000

Type Values Removed Values Added
Description A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Cisco Firepower 3100 and 4200 Series devices could allow an authenticated, remote attacker to consume resources that are associated with incoming TLS 1.3 connections, which eventually could cause the device to stop accepting any new SSL/TLS or VPN requests. This vulnerability is due to the implementation of the TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. An attacker could exploit this vulnerability by sending a large number of TLS 1.3 connections with the specific TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. A successful exploit could allow the attacker to cause a denial of service (DoS) condition where no new incoming encrypted connections are accepted. The device must be reloaded to clear this condition. Note: These incoming TLS 1.3 connections include both data traffic and user-management traffic. After the device is in the vulnerable state, no new encrypted connections can be accepted.
Title Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 3100 and 4200 Series TLS Cipher Denial of Service Vulnerability
Weaknesses CWE-404
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H'}

Subscriptions

Cisco Adaptive Security Appliance Software Firepower Threat Defense Firepower Threat Defense Software Secure Firewall 3105 Secure Firewall 3110 Secure Firewall 3120 Secure Firewall 3130 Secure Firewall 3140 Secure Firewall 4215 Secure Firewall 4225 Secure Firewall 4245
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2025-09-03T17:39:26.506Z

Reserved: 2024-10-10T19:15:13.212Z

Link: CVE-2025-20127

cve-icon Vulnrichment

Updated: 2025-08-14T18:41:46.619Z

cve-icon NVD

Status : Analyzed

Published: 2025-08-14T17:15:33.907

Modified: 2025-08-25T14:35:24.387

Link: CVE-2025-20127

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-08-16T21:41:10Z

Weaknesses