CVE-2025-20127
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Firepower 3100 and 4200 Series devices could allow an authenticated, remote attacker to consume resources associated with incoming TLS 1.3 connections, eventually causing the device to stop accepting any new SSL/TLS or VPN requests. The issue is due to the implementation of the TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. Sending a large number of TLS 1.3 connections with this cipher can cause a DoS condition where no new incoming encrypted connections are accepted. The device must be reloaded to clear this condition.
Risk Assessment
An attack can cause denial of service for new encrypted connections, including data and management traffic, requiring manual device reload.
Recommendation
Apply Cisco updates for ASA and FTD that address this vulnerability. Limit the number of TLS 1.3 connections with this cipher if possible.
Other vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
See all- CVE-2026-20082High
A vulnerability in the handling of connection limits in Cisco Secure Firewall ASA could allow an unauthenticated, remote attacker to incorrectly drop incoming TCP SYN packets. An attacker could exploit this vulnerability to block all incoming TCP connections to the device.
- CVE-2026-20100High
A vulnerability in the LUA interpreter of the Remote Access SSL VPN feature of Cisco Secure Firewall ASA and FTD Software could allow an authenticated, remote attacker with a valid VPN connection to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
- CVE-2026-20073Medium
A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should be denied through an affected device. The issue is due to improper error handling when a device joining a cluster runs out of memory while replicating access control rules.
Original NVD description (English source)
A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Cisco Firepower 3100 and 4200 Series devices could allow an authenticated, remote attacker to consume resources that are associated with incoming TLS 1.3 connections, which eventually could cause the device to stop accepting any new SSL/TLS or VPN requests. This vulnerability is due to the implementation of the TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. An attacker could exploit this vulnerability by sending a large number of TLS 1.3 connections with the specific TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. A successful exploit could allow the attacker to cause a denial of service (DoS) condition where no new incoming encrypted connections are accepted. The device must be reloaded to clear this condition. Note: These incoming TLS 1.3 connections include both data traffic and user-management traffic. After the device is in the vulnerable state, no new encrypted connections can be accepted.