Introduction
An attacker can disrupt enterprise VPN and management connectivity without warning, and users and administrators then cannot establish new secure sessions. CVE-2025-20127 is a critical resource exhaustion flaw in Cisco Secure Firewall ASA and FTD software for Firepower 3100 and 4200 Series devices. It directly affects encrypted traffic and the ability to manage the device.
About the affected products: Cisco is a global leader in networking and security, and its Firepower and ASA product lines are widely deployed in enterprise and critical infrastructure environments. The Firepower 3100 and 4200 Series are high-performance security appliances that provide firewall, VPN, and threat defense functions to organizations worldwide.
Technical information
CVE-2025-20127 is caused by improper resource management in the TLS 1.3 implementation for the TLS_CHACHA20_POLY1305_SHA256 cipher suite within Cisco Secure Firewall ASA and FTD software running on Firepower 3100 and 4200 Series devices. When an authenticated remote attacker opens a large number of TLS 1.3 connections with this cipher, the device fails to properly release the resources tied to those connections, and system resources drain gradually. Once they are exhausted, the device refuses all new SSL/TLS and VPN connections, for user data and management traffic alike. The only recovery is a device reload. The vulnerability is classified under CWE-404 (Improper Resource Shutdown or Release).
No public code snippets or proof-of-concept details are available. The flaw is specific to how TLS 1.3 sessions handle the TLS_CHACHA20_POLY1305_SHA256 cipher. An attacker must be authenticated to exploit it. That requirement somewhat limits exposure but does not eliminate it, especially in environments with many authorized users or exposed management interfaces.
Affected systems and versions
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software for Firepower 3100 and 4200 Series devices
- Cisco Secure Firewall Threat Defense (FTD) Software for Firepower 3100 and 4200 Series devices
- Only devices running software that supports TLS 1.3 with the TLS_CHACHA20_POLY1305_SHA256 cipher suite are affected
- The vulnerability affects both data and management traffic
- Exact affected version numbers are not specified in the available advisory
Vendor security history
Cisco's security appliance product lines have a history of recurring vulnerabilities, especially in TLS and resource management. In April 2024, multiple high-severity vulnerabilities (CVE-2024-20353, CVE-2024-20359, CVE-2024-20358) were disclosed in ASA and FTD products, including denial of service and remote code execution issues. Cisco generally publishes advisories and patches promptly, but how often these issues appear points to persistent problems with secure protocol implementation and resource management.
References
- Cisco Security Advisory for CVE-2025-20127
- NVD Entry for CVE-2025-20127
- CWE-404: Improper Resource Shutdown or Release
- CSA Singapore Alert: Cisco ASA and FTD Vulnerabilities
- Stack.watch: Cisco Firepower Threat Defense Vulnerabilities
- CyberMaxx: High Severity Cisco ASA and FTD Firewall Vulnerabilities
