Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software DHCP Denial of Service Vulnerability

🚨SEVERITY: MEDIUM — CVSS 4.3Security Advisory

TL;DR 📌

  • A vulnerability in the DHCP client functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to exhaust available memory. This vulnerability is due to improper validation of incoming DHCP packets. An attacker could exploit this vulnerability by repeatedly sending crafted…
  • Highest CVSS: 4.3 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20135.

What it is

CVE-2025-20135 sits in the DHCP client functionality of Cisco Secure Firewall ASA Software and Secure FTD Software. It’s caused by improper validation of incoming DHCP packets.

The access path is adjacent and unauthenticated: an attacker on the same network segment as an affected interface can repeatedly send crafted DHCPv4 packets without needing credentials. On ASA, this affects interfaces where the DHCP client feature is enabled. On FTD, it affects data interfaces only — Cisco states that DHCP traffic received on the dedicated management interface cannot trigger the vulnerability, and Secure Firewall Management Center (FMC) Software is confirmed not vulnerable.

A successful exploit exhausts available memory on the device, which affects availability of services and prevents new processes from starting. This results in a denial-of-service condition that requires a manual reboot to clear — there’s no self-recovery.

What to do

  • Check exposure first, not just presence of the software. On ASA, run show ip | include DHCP to see which interfaces have DHCP client enabled, and show running-config | include address dhcp to confirm DHCP client configuration. Empty output on both means the device isn’t affected. On FTD, check via FDM under Interfaces > View All Interfaces — any data interface with Type set to DHCP is exposed.
  • FMC is confirmed not vulnerable, so no action is needed there specifically for this CVE.
  • There are no workarounds. The only fix is upgrading to a corrected release. Use the Cisco Software Checker against your current ASA or FTD release to get the specific “First Fixed” version for your platform, since the advisory does not list fixed versions directly in a simple table — the checker will return the exact release for your hardware and software combination.
  • If DHCP client is not in use on any interface, this can be deprioritised relative to other patches in the same August 2025 bundled publication, but confirm that with the CLI checks above rather than assuming.
  • Given that recovery requires a manual reboot, treat any interface with DHCP client enabled and facing untrusted or shared segments as a priority for patching, even before a wider maintenance window.

For leadership 🧭

Executive summary. An unauthenticated attacker on the same network segment as an ASA or FTD interface with DHCP client enabled can force that firewall offline until someone physically or remotely reboots it. There’s no workaround, so exposed interfaces should be identified and patched ahead of the normal change cycle.

Why it matters:

  • Any ASA interface with DHCP client enabled, or FTD data interface configured as a DHCP client, can be crashed by an adjacent attacker with no credentials required.
  • The failure mode is memory exhaustion that halts new process creation — the device does not recover on its own and needs a manual reboot, meaning real downtime on a security control.
  • FTD management interfaces and FMC are confirmed not vulnerable, so the exposure is specifically tied to data-plane DHCP client configuration on the firewall itself.
  • No workaround exists, so any exposed interface remains at risk until the software is upgraded.

Now / Next / Later:

  • Now: Run show ip | include DHCP and show running-config | include address dhcp on ASA, or check Interfaces > View All Interfaces in FDM for FTD, to find which devices actually have DHCP client enabled on a data interface.
  • Next: For any device with DHCP client enabled, use the Cisco Software Checker against your current release to get the exact fixed version and schedule the upgrade, prioritising interfaces facing shared or untrusted segments given the manual-reboot recovery.
  • Later: Where DHCP client isn’t operationally required on firewall interfaces, disable it to remove this and future DHCP-parsing exposure permanently, and fold this check into standard firewall hardening reviews.

Source