CVE-2025-20127 Details

A denial-of-service vulnerability has been identified in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software, specifically for Firepower 3100 and 4200 Series devices. This vulnerability arises from the TLS 1.3 implementation of the cipher TLS_CHACHA20_POLY1305_SHA256. An authenticated, remote attacker could exploit this vulnerability by initiating a high volume of TLS 1.3 connections using this specific cipher. The exploitation would consume resources related to incoming TLS 1.3 connections, including data traffic and user-management traffic, eventually causing the device to reject any new SSL/TLS or VPN requests. Once the device reaches this state, it must be rebooted to restore normal functionality.

To address this vulnerability, the TLS 1.3 cipher TLS_CHACHA20_POLY1305_SHA256 can be removed using the 'no ssl cipher tlsv1.3 custom "TLS_CHACHA20_POLY1305_SHA256"' command. Cisco has also released free software updates that address this vulnerability. Customers with service contracts should obtain these updates through their usual channels. For those without service contracts, upgrades can be requested from the Cisco Technical Assistance Center.