Introduction
An unexpected device reload can cut off remote access for an entire workforce at once. That can halt business operations and set off cascading failures elsewhere in the organization. CVE-2025-20244 affects the Remote Access SSL VPN service in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) software. An authenticated VPN user can trigger a denial-of-service condition by sending a crafted HTTP request.
Cisco ASA and FTD are core parts of enterprise network security and are widely deployed for firewall, VPN, and threat defense. Cisco is a major networking and security vendor, and its firewall and VPN products protect critical infrastructure for businesses, governments, and service providers worldwide.
Technical information
CVE-2025-20244 comes from incomplete error checking when the Remote Access SSL VPN service parses HTTP header field values. When an authenticated VPN user sends a specially crafted HTTP request with malformed header data, the device's error-handling routines do not validate the input properly. The malformed request then reaches code paths that are not equipped to handle that data, and the entire device reloads unexpectedly.
The vulnerability is classified under CWE-1287 (Improper Validation of Specified Type of Input). The root cause is insufficient validation logic in the HTTP header parsing functions. An attacker needs valid VPN credentials and access to the SSL VPN service. No public code snippets or proof-of-concept details are available for this vulnerability.
A successful attack reloads the full device, which denies service to every user and service that relies on the affected Cisco ASA or FTD device. That includes firewall filtering, site-to-site VPNs, and other security functions. The reload can take several minutes, and network security and connectivity are disrupted the whole time.
Affected systems and versions
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software: Remote Access SSL VPN service
- Cisco Secure Firewall Threat Defense (FTD) Software: Remote Access SSL VPN service
The advisory does not list specific affected version numbers. Organizations should check the official Cisco advisory for the latest affected and fixed version information:
Vendor security history
Cisco's ASA and FTD product lines have a documented history of critical vulnerabilities, especially in VPN and web services components. Notable recent issues include:
- CVE-2023-20269: Zero-day in ASA/FTD SSL VPN actively exploited by ransomware groups (Arctic Wolf, Tenable)
- CVE-2024-20481: Remote Access VPN DoS in ASA/FTD (The Hacker News)
Cisco usually responds quickly with advisories and patches. Even so, input validation flaws keep recurring in its VPN and web services, which points to persistent architectural problems.
