CVE-2025-20136: 
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation

CVE-2025-20136 is a denial-of-service (DoS) vulnerability in the NAT DNS inspection function of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The flaw allows an unauthenticated, remote attacker to cause an affected device to reload unexpectedly by triggering an infinite loop during DNS packet processing. It was discovered internally by Jason Crowder of the Cisco Advanced Security Initiatives Group (ASIG) and publicly disclosed on August 14, 2025, as part of Cisco's August 2025 Semiannual Firewall Security Advisory Bundled Publication. The vulnerability carries a CVSS v3.1 base score of 8.6 (High) (Cisco Advisory).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). The vulnerability is triggered when a Cisco ASA or FTD device processes DNS packets while both DNS inspection and NAT are simultaneously enabled — specifically when the device is configured for NAT44, NAT64, or NAT46 translation modes. An attacker exploits this by sending crafted DNS packets that match a static NAT rule with DNS inspection active, causing the device's packet-processing logic to enter an infinite loop with no exit condition. No authentication or special privileges are required, and the attack can be launched remotely over the network (Cisco Advisory).

Successful exploitation causes the affected Cisco ASA or FTD device to reload unexpectedly, resulting in a complete denial of service condition. Because these devices function as network security perimeters and firewalls, an unexpected reload disrupts all traffic passing through them, potentially severing network connectivity and disabling security enforcement for the duration of the outage. There is no confidentiality or integrity impact — the vulnerability is purely an availability concern — but the scope is marked as Changed, indicating that the DoS condition can affect resources beyond the vulnerable component itself (Cisco Advisory).

As of the disclosure date, Cisco PSIRT is not aware of any public announcements or malicious use of this vulnerability in the wild, and no public proof-of-concept exploit code has been identified (Cisco Advisory). The EPSS score is approximately 0.138%, indicating a low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Cisco ASA or FTD devices using tools such as Shodan or Censys, filtering for Cisco firewall banners or known management ports.
2. Verify preconditions: Confirm the target device has both NAT (NAT44, NAT64, or NAT46) and DNS inspection enabled. This can be inferred from exposed service behavior or configuration leaks.
3. Craft malicious DNS packets: Construct DNS packets specifically designed to match a static NAT rule on the target device while triggering the infinite loop condition in the DNS inspection code path.
4. Transmit crafted packets: Send the crafted DNS packets through the affected device (i.e., traffic that would be subject to NAT and DNS inspection processing), targeting the relevant NAT-translated address.
5. Trigger DoS: The device enters an infinite loop while processing the malformed DNS packet, consuming all available CPU resources and causing the device to reload, resulting in a denial of service (Cisco Advisory).

• Network: Unusual or repeated DNS query traffic directed at or through a Cisco ASA/FTD device, particularly packets matching static NAT rules; unexpected spikes in DNS traffic volume from external sources.
• Logs: Syslog messages indicating unexpected device reload or crash events; messages referencing NAT or DNS inspection processing errors immediately prior to reload.
• Device Behavior: Unexpected or repeated device reloads without administrative action; high CPU utilization on the firewall process associated with DNS or NAT inspection tasks.
• System: Crash dump files or core files generated on the ASA/FTD device following an unexpected reload, which may reference the NAT DNS inspection code path (Cisco Advisory).

Cisco has released free software updates that address this vulnerability; there are no workarounds available. Administrators should upgrade affected Cisco Secure Firewall ASA and FTD Software to a fixed release as identified via the Cisco Software Checker tool on the Cisco Security Advisories page. As an interim measure, organizations should verify whether both NAT and DNS inspection are simultaneously enabled using show running-config nat and show running-config policy-map | include inspect dns — if DNS inspection is not operationally required, disabling it reduces exposure. Customers without service contracts should contact Cisco TAC for access to free security updates (Cisco Advisory).

CVE-2025-20136 was disclosed as part of Cisco's August 2025 Semiannual Firewall Security Advisory Bundled Publication, which also included a CVSS 10.0 critical flaw in Cisco FMC (CVE-2025-20265), drawing significant media attention to the overall advisory bundle. Coverage from outlets such as BleepingComputer, The Hacker News, and CIS highlighted the broader bundle rather than this specific DoS vulnerability in isolation (BleepingComputer, The Hacker News). The CIS issued an advisory noting multiple vulnerabilities in Cisco security products could allow for arbitrary code execution and DoS (CIS Advisory). Community reaction focused primarily on the critical FMC flaw, with CVE-2025-20136 receiving moderate attention as a high-severity DoS risk for organizations running NAT with DNS inspection.