---
id: CVE-2025-20224
title: >-
  A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco
  Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall
  Threat Defense (FTD) Software could allow an unauthenticated, remote attacker
  t…
summary: >-
  A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco
  Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall
  Threat Defense (FTD) Software could allow an unauthenticated, remote attacker
  t…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'
cwe:
  - CWE-401
vendor: cisco
product: secure_firewall_threat_defense
affected:
  - secure_firewall_threat_defense = 6.2.3
  - secure_firewall_threat_defense = 6.2.3.1
  - secure_firewall_threat_defense = 6.2.3.2
  - secure_firewall_threat_defense = 6.2.3.3
  - secure_firewall_threat_defense = 6.2.3.4
  - secure_firewall_threat_defense = 6.2.3.5
  - secure_firewall_threat_defense = 6.2.3.6
  - secure_firewall_threat_defense = 6.2.3.7
  - secure_firewall_threat_defense = 6.2.3.8
  - secure_firewall_threat_defense = 6.2.3.9
  - secure_firewall_threat_defense = 6.2.3.10
  - secure_firewall_threat_defense = 6.2.3.11
  - secure_firewall_threat_defense = 6.2.3.12
  - secure_firewall_threat_defense = 6.2.3.13
  - secure_firewall_threat_defense = 6.2.3.14
  - secure_firewall_threat_defense = 6.2.3.15
  - secure_firewall_threat_defense = 6.2.3.16
  - secure_firewall_threat_defense = 6.2.3.17
  - secure_firewall_threat_defense = 6.2.3.18
  - secure_firewall_threat_defense = 6.4.0
  - secure_firewall_threat_defense = 6.4.0.1
  - secure_firewall_threat_defense = 6.4.0.2
  - secure_firewall_threat_defense = 6.4.0.3
  - secure_firewall_threat_defense = 6.4.0.4
  - secure_firewall_threat_defense = 6.4.0.5
  - secure_firewall_threat_defense = 6.4.0.6
  - secure_firewall_threat_defense = 6.4.0.7
  - secure_firewall_threat_defense = 6.4.0.8
  - secure_firewall_threat_defense = 6.4.0.9
  - secure_firewall_threat_defense = 6.4.0.10
  - secure_firewall_threat_defense = 6.4.0.11
  - secure_firewall_threat_defense = 6.4.0.12
  - secure_firewall_threat_defense = 6.4.0.13
  - secure_firewall_threat_defense = 6.4.0.14
  - secure_firewall_threat_defense = 6.4.0.15
  - secure_firewall_threat_defense = 6.4.0.16
  - secure_firewall_threat_defense = 6.4.0.17
  - secure_firewall_threat_defense = 6.4.0.18
  - secure_firewall_threat_defense = 6.6.0
  - secure_firewall_threat_defense = 6.6.0.1
  - secure_firewall_threat_defense = 6.6.1
  - secure_firewall_threat_defense = 6.6.3
  - secure_firewall_threat_defense = 6.6.4
  - secure_firewall_threat_defense = 6.6.5
  - secure_firewall_threat_defense = 6.6.5.1
  - secure_firewall_threat_defense = 6.6.5.2
  - secure_firewall_threat_defense = 6.6.7
  - secure_firewall_threat_defense = 6.6.7.1
  - secure_firewall_threat_defense = 6.6.7.2
  - secure_firewall_threat_defense = 7.0.0
  - secure_firewall_threat_defense = 7.0.0.1
  - secure_firewall_threat_defense = 7.0.1
  - secure_firewall_threat_defense = 7.0.1.1
  - secure_firewall_threat_defense = 7.0.2
  - secure_firewall_threat_defense = 7.0.2.1
  - secure_firewall_threat_defense = 7.0.3
  - secure_firewall_threat_defense = 7.0.4
  - secure_firewall_threat_defense = 7.0.5
  - secure_firewall_threat_defense = 7.0.6
  - secure_firewall_threat_defense = 7.0.6.1
  - secure_firewall_threat_defense = 7.0.6.2
  - secure_firewall_threat_defense = 7.0.6.3
  - secure_firewall_threat_defense = 7.0.7
  - secure_firewall_threat_defense = 7.1.0
  - secure_firewall_threat_defense = 7.1.0.1
  - secure_firewall_threat_defense = 7.1.0.2
  - secure_firewall_threat_defense = 7.1.0.3
  - secure_firewall_threat_defense = 7.2.0
  - secure_firewall_threat_defense = 7.2.0.1
  - secure_firewall_threat_defense = 7.2.1
  - secure_firewall_threat_defense = 7.2.2
  - secure_firewall_threat_defense = 7.2.3
  - secure_firewall_threat_defense = 7.2.4
  - secure_firewall_threat_defense = 7.2.4.1
  - secure_firewall_threat_defense = 7.2.5
  - secure_firewall_threat_defense = 7.2.5.1
  - secure_firewall_threat_defense = 7.2.5.2
  - secure_firewall_threat_defense = 7.2.6
  - secure_firewall_threat_defense = 7.2.7
  - secure_firewall_threat_defense = 7.2.8
  - secure_firewall_threat_defense = 7.2.8.1
  - secure_firewall_threat_defense = 7.2.9
  - secure_firewall_threat_defense = 7.3.0
  - secure_firewall_threat_defense = 7.3.1
  - secure_firewall_threat_defense = 7.3.1.1
  - secure_firewall_threat_defense = 7.3.1.2
  - secure_firewall_threat_defense = 7.4.0
  - secure_firewall_threat_defense = 7.4.1
  - secure_firewall_threat_defense = 7.4.1.1
  - secure_firewall_threat_defense = 7.4.2
  - secure_firewall_threat_defense = 7.4.2.1
  - secure_firewall_threat_defense = 7.4.2.2
  - secure_firewall_threat_defense = 7.6.0
  - secure_firewall_threat_defense = 7.7.0
  - adaptive_security_appliance_software = 9.8.1
  - adaptive_security_appliance_software = 9.8.1.5
  - adaptive_security_appliance_software = 9.8.1.7
  - adaptive_security_appliance_software = 9.8.2
  - adaptive_security_appliance_software = 9.8.2.8
  - adaptive_security_appliance_software = 9.8.2.14
published: '2025-08-14'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T13:18:35.717'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-20224'
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-ios-dos-DOESHWHy
    label: psirt@cisco.com
tags:
  - nvd
epss: 0.00715
epssPercentile: 0.5164
ingestedAt: '2026-09-18T12:40:48.880Z'
---

## Overview

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition.

 This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to partially exhaust system memory, causing system instability like being unable to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.

## Affected

- `secure_firewall_threat_defense = 6.2.3`
- `secure_firewall_threat_defense = 6.2.3.1`
- `secure_firewall_threat_defense = 6.2.3.2`
- `secure_firewall_threat_defense = 6.2.3.3`
- `secure_firewall_threat_defense = 6.2.3.4`
- `secure_firewall_threat_defense = 6.2.3.5`
- `secure_firewall_threat_defense = 6.2.3.6`
- `secure_firewall_threat_defense = 6.2.3.7`
- `secure_firewall_threat_defense = 6.2.3.8`
- `secure_firewall_threat_defense = 6.2.3.9`
- `secure_firewall_threat_defense = 6.2.3.10`
- `secure_firewall_threat_defense = 6.2.3.11`
- `secure_firewall_threat_defense = 6.2.3.12`
- `secure_firewall_threat_defense = 6.2.3.13`
- `secure_firewall_threat_defense = 6.2.3.14`
- `secure_firewall_threat_defense = 6.2.3.15`
- `secure_firewall_threat_defense = 6.2.3.16`
- `secure_firewall_threat_defense = 6.2.3.17`
- `secure_firewall_threat_defense = 6.2.3.18`
- `secure_firewall_threat_defense = 6.4.0`
- `secure_firewall_threat_defense = 6.4.0.1`
- `secure_firewall_threat_defense = 6.4.0.2`
- `secure_firewall_threat_defense = 6.4.0.3`
- `secure_firewall_threat_defense = 6.4.0.4`
- `secure_firewall_threat_defense = 6.4.0.5`
- `secure_firewall_threat_defense = 6.4.0.6`
- `secure_firewall_threat_defense = 6.4.0.7`
- `secure_firewall_threat_defense = 6.4.0.8`
- `secure_firewall_threat_defense = 6.4.0.9`
- `secure_firewall_threat_defense = 6.4.0.10`
- `secure_firewall_threat_defense = 6.4.0.11`
- `secure_firewall_threat_defense = 6.4.0.12`
- `secure_firewall_threat_defense = 6.4.0.13`
- `secure_firewall_threat_defense = 6.4.0.14`
- `secure_firewall_threat_defense = 6.4.0.15`
- `secure_firewall_threat_defense = 6.4.0.16`
- `secure_firewall_threat_defense = 6.4.0.17`
- `secure_firewall_threat_defense = 6.4.0.18`
- `secure_firewall_threat_defense = 6.6.0`
- `secure_firewall_threat_defense = 6.6.0.1`
- `secure_firewall_threat_defense = 6.6.1`
- `secure_firewall_threat_defense = 6.6.3`
- `secure_firewall_threat_defense = 6.6.4`
- `secure_firewall_threat_defense = 6.6.5`
- `secure_firewall_threat_defense = 6.6.5.1`
- `secure_firewall_threat_defense = 6.6.5.2`
- `secure_firewall_threat_defense = 6.6.7`
- `secure_firewall_threat_defense = 6.6.7.1`
- `secure_firewall_threat_defense = 6.6.7.2`
- `secure_firewall_threat_defense = 7.0.0`
- `secure_firewall_threat_defense = 7.0.0.1`
- `secure_firewall_threat_defense = 7.0.1`
- `secure_firewall_threat_defense = 7.0.1.1`
- `secure_firewall_threat_defense = 7.0.2`
- `secure_firewall_threat_defense = 7.0.2.1`
- `secure_firewall_threat_defense = 7.0.3`
- `secure_firewall_threat_defense = 7.0.4`
- `secure_firewall_threat_defense = 7.0.5`
- `secure_firewall_threat_defense = 7.0.6`
- `secure_firewall_threat_defense = 7.0.6.1`
- `secure_firewall_threat_defense = 7.0.6.2`
- `secure_firewall_threat_defense = 7.0.6.3`
- `secure_firewall_threat_defense = 7.0.7`
- `secure_firewall_threat_defense = 7.1.0`
- `secure_firewall_threat_defense = 7.1.0.1`
- `secure_firewall_threat_defense = 7.1.0.2`
- `secure_firewall_threat_defense = 7.1.0.3`
- `secure_firewall_threat_defense = 7.2.0`
- `secure_firewall_threat_defense = 7.2.0.1`
- `secure_firewall_threat_defense = 7.2.1`
- `secure_firewall_threat_defense = 7.2.2`
- `secure_firewall_threat_defense = 7.2.3`
- `secure_firewall_threat_defense = 7.2.4`
- `secure_firewall_threat_defense = 7.2.4.1`
- `secure_firewall_threat_defense = 7.2.5`
- `secure_firewall_threat_defense = 7.2.5.1`
- `secure_firewall_threat_defense = 7.2.5.2`
- `secure_firewall_threat_defense = 7.2.6`
- `secure_firewall_threat_defense = 7.2.7`
- `secure_firewall_threat_defense = 7.2.8`
- `secure_firewall_threat_defense = 7.2.8.1`
- `secure_firewall_threat_defense = 7.2.9`
- `secure_firewall_threat_defense = 7.3.0`
- `secure_firewall_threat_defense = 7.3.1`
- `secure_firewall_threat_defense = 7.3.1.1`
- `secure_firewall_threat_defense = 7.3.1.2`
- `secure_firewall_threat_defense = 7.4.0`
- `secure_firewall_threat_defense = 7.4.1`
- `secure_firewall_threat_defense = 7.4.1.1`
- `secure_firewall_threat_defense = 7.4.2`
- `secure_firewall_threat_defense = 7.4.2.1`
- `secure_firewall_threat_defense = 7.4.2.2`
- `secure_firewall_threat_defense = 7.6.0`
- `secure_firewall_threat_defense = 7.7.0`
- `adaptive_security_appliance_software = 9.8.1`
- `adaptive_security_appliance_software = 9.8.1.5`
- `adaptive_security_appliance_software = 9.8.1.7`
- `adaptive_security_appliance_software = 9.8.2`
- `adaptive_security_appliance_software = 9.8.2.8`
- `adaptive_security_appliance_software = 9.8.2.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.