Network Address Translation DNS Inspection Vulnerability in Cisco Secure Firewall
CVE-2025-20136

8.6HIGH

Key Information:

Vendor

Cisco
Status
Cisco Adaptive Security Appliance (asa) Software
Cisco Firepower Threat Defense Software
Vendor
CVE Published:
14 August 2025

Badges

👾 Exploit Exists

What is CVE-2025-20136?

A vulnerability exists in the handling of IPv4 and IPv6 Network Address Translation (NAT) DNS inspection on Cisco Secure Firewall devices. This flaw can be exploited by unauthenticated remote attackers who send specially crafted DNS packets through a targeted device configured for NAT44, NAT64, or NAT46. The vulnerability stems from an infinite loop condition that triggers during the processing of DNS packets, leading to unexpected device reloads. If successfully exploited, this condition results in a denial of service (DoS), disrupting the functionality of the affected systems.

Affected Version(s)

Cisco Adaptive Security Appliance (ASA) Software 9.12.3

Cisco Adaptive Security Appliance (ASA) Software 9.8.3

Cisco Adaptive Security Appliance (ASA) Software 9.12.1

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-20136 : Network Address Translation DNS Inspection Vulnerability in Cisco Secure Firewall