CVE-2025-20219 (GCVE-0-2025-20219)
Vulnerability from cvelistv5
Published
2025-08-14 16:28
Modified
2025-08-14 20:44
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-284 - Improper Access Control
Summary
A vulnerability in the implementation of access control rules for loopback interfaces in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should have been blocked to a loopback interface.
This vulnerability is due to improper enforcement of access control rules for loopback interfaces. An attacker could exploit this vulnerability by sending traffic to a loopback interface on an affected device. A successful exploit could allow the attacker to bypass configured access control rules and send traffic that should have been blocked to a loopback interface on the device.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Cisco | Cisco Adaptive Security Appliance (ASA) Software |
Version: 9.18.2 Version: 9.18.2.5 Version: 9.18.2.7 Version: 9.19.1 Version: 9.18.2.8 Version: 9.18.3 Version: 9.19.1.5 Version: 9.19.1.9 Version: 9.18.3.39 Version: 9.19.1.12 Version: 9.18.3.46 Version: 9.19.1.18 Version: 9.18.3.53 Version: 9.18.3.55 Version: 9.18.3.56 Version: 9.20.1 Version: 9.19.1.22 Version: 9.18.4 Version: 9.20.1.5 Version: 9.18.4.5 Version: 9.19.1.24 Version: 9.18.4.8 Version: 9.20.2 Version: 9.19.1.27 Version: 9.18.4.22 Version: 9.20.2.10 Version: 9.19.1.28 Version: 9.18.4.24 Version: 9.20.2.21 Version: 9.19.1.31 Version: 9.18.4.29 Version: 9.20.2.22 Version: 9.18.4.34 Version: 9.20.3 Version: 9.18.4.40 Version: 9.22.1.1 Version: 9.20.3.4 Version: 9.18.4.47 Version: 9.20.3.7 Version: 9.19.1.37 Version: 9.20.3.9 Version: 9.19.1.38 Version: 9.18.4.50 Version: 9.22.1.2 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-20219",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-14T20:44:20.753964Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-14T20:44:27.252Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Adaptive Security Appliance (ASA) Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "9.18.2"
},
{
"status": "affected",
"version": "9.18.2.5"
},
{
"status": "affected",
"version": "9.18.2.7"
},
{
"status": "affected",
"version": "9.19.1"
},
{
"status": "affected",
"version": "9.18.2.8"
},
{
"status": "affected",
"version": "9.18.3"
},
{
"status": "affected",
"version": "9.19.1.5"
},
{
"status": "affected",
"version": "9.19.1.9"
},
{
"status": "affected",
"version": "9.18.3.39"
},
{
"status": "affected",
"version": "9.19.1.12"
},
{
"status": "affected",
"version": "9.18.3.46"
},
{
"status": "affected",
"version": "9.19.1.18"
},
{
"status": "affected",
"version": "9.18.3.53"
},
{
"status": "affected",
"version": "9.18.3.55"
},
{
"status": "affected",
"version": "9.18.3.56"
},
{
"status": "affected",
"version": "9.20.1"
},
{
"status": "affected",
"version": "9.19.1.22"
},
{
"status": "affected",
"version": "9.18.4"
},
{
"status": "affected",
"version": "9.20.1.5"
},
{
"status": "affected",
"version": "9.18.4.5"
},
{
"status": "affected",
"version": "9.19.1.24"
},
{
"status": "affected",
"version": "9.18.4.8"
},
{
"status": "affected",
"version": "9.20.2"
},
{
"status": "affected",
"version": "9.19.1.27"
},
{
"status": "affected",
"version": "9.18.4.22"
},
{
"status": "affected",
"version": "9.20.2.10"
},
{
"status": "affected",
"version": "9.19.1.28"
},
{
"status": "affected",
"version": "9.18.4.24"
},
{
"status": "affected",
"version": "9.20.2.21"
},
{
"status": "affected",
"version": "9.19.1.31"
},
{
"status": "affected",
"version": "9.18.4.29"
},
{
"status": "affected",
"version": "9.20.2.22"
},
{
"status": "affected",
"version": "9.18.4.34"
},
{
"status": "affected",
"version": "9.20.3"
},
{
"status": "affected",
"version": "9.18.4.40"
},
{
"status": "affected",
"version": "9.22.1.1"
},
{
"status": "affected",
"version": "9.20.3.4"
},
{
"status": "affected",
"version": "9.18.4.47"
},
{
"status": "affected",
"version": "9.20.3.7"
},
{
"status": "affected",
"version": "9.19.1.37"
},
{
"status": "affected",
"version": "9.20.3.9"
},
{
"status": "affected",
"version": "9.19.1.38"
},
{
"status": "affected",
"version": "9.18.4.50"
},
{
"status": "affected",
"version": "9.22.1.2"
}
]
},
{
"defaultStatus": "unknown",
"product": "Cisco Firepower Threat Defense Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "7.3.0"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.3.1.1"
},
{
"status": "affected",
"version": "7.4.0"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.4.1.1"
},
{
"status": "affected",
"version": "7.3.1.2"
},
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.4.2"
},
{
"status": "affected",
"version": "7.4.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the implementation of access control rules for loopback interfaces in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should have been blocked to a loopback interface.\r\n\r\nThis vulnerability is due to improper enforcement of access control rules for loopback interfaces. An attacker could exploit this vulnerability by sending traffic to a loopback interface on an affected device. A successful exploit could allow the attacker to bypass configured access control rules and send traffic\u0026nbsp;that should have been blocked to a loopback interface on the device."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-14T16:28:40.010Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-asa-ftd-acl-bypass-mtPze9Yh",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-acl-bypass-mtPze9Yh"
}
],
"source": {
"advisory": "cisco-sa-asa-ftd-acl-bypass-mtPze9Yh",
"defects": [
"CSCwi57783"
],
"discovery": "INTERNAL"
},
"title": "Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control Bypass Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2025-20219",
"datePublished": "2025-08-14T16:28:40.010Z",
"dateReserved": "2024-10-10T19:15:13.233Z",
"dateUpdated": "2025-08-14T20:44:27.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-20219\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-08-14T20:44:20.753964Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-08-14T18:03:41.159Z\"}}], \"cna\": {\"title\": \"Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control Bypass Vulnerability\", \"source\": {\"defects\": [\"CSCwi57783\"], \"advisory\": \"cisco-sa-asa-ftd-acl-bypass-mtPze9Yh\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco Adaptive Security Appliance (ASA) Software\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.18.2\"}, {\"status\": \"affected\", \"version\": \"9.18.2.5\"}, {\"status\": \"affected\", \"version\": \"9.18.2.7\"}, {\"status\": \"affected\", \"version\": \"9.19.1\"}, {\"status\": \"affected\", \"version\": \"9.18.2.8\"}, {\"status\": \"affected\", \"version\": \"9.18.3\"}, {\"status\": \"affected\", \"version\": \"9.19.1.5\"}, {\"status\": \"affected\", \"version\": \"9.19.1.9\"}, {\"status\": \"affected\", \"version\": \"9.18.3.39\"}, {\"status\": \"affected\", \"version\": \"9.19.1.12\"}, {\"status\": \"affected\", \"version\": \"9.18.3.46\"}, {\"status\": \"affected\", \"version\": \"9.19.1.18\"}, {\"status\": \"affected\", \"version\": \"9.18.3.53\"}, {\"status\": \"affected\", \"version\": \"9.18.3.55\"}, {\"status\": \"affected\", \"version\": \"9.18.3.56\"}, {\"status\": \"affected\", \"version\": \"9.20.1\"}, {\"status\": \"affected\", \"version\": \"9.19.1.22\"}, {\"status\": \"affected\", \"version\": \"9.18.4\"}, {\"status\": \"affected\", \"version\": \"9.20.1.5\"}, {\"status\": \"affected\", \"version\": \"9.18.4.5\"}, {\"status\": \"affected\", \"version\": \"9.19.1.24\"}, {\"status\": \"affected\", \"version\": \"9.18.4.8\"}, {\"status\": \"affected\", \"version\": \"9.20.2\"}, {\"status\": \"affected\", \"version\": \"9.19.1.27\"}, {\"status\": \"affected\", \"version\": \"9.18.4.22\"}, {\"status\": \"affected\", \"version\": \"9.20.2.10\"}, {\"status\": \"affected\", \"version\": \"9.19.1.28\"}, {\"status\": \"affected\", \"version\": \"9.18.4.24\"}, {\"status\": \"affected\", \"version\": \"9.20.2.21\"}, {\"status\": \"affected\", \"version\": \"9.19.1.31\"}, {\"status\": \"affected\", \"version\": \"9.18.4.29\"}, {\"status\": \"affected\", \"version\": \"9.20.2.22\"}, {\"status\": \"affected\", \"version\": \"9.18.4.34\"}, {\"status\": \"affected\", \"version\": \"9.20.3\"}, {\"status\": \"affected\", \"version\": \"9.18.4.40\"}, {\"status\": \"affected\", \"version\": \"9.22.1.1\"}, {\"status\": \"affected\", \"version\": \"9.20.3.4\"}, {\"status\": \"affected\", \"version\": \"9.18.4.47\"}, {\"status\": \"affected\", \"version\": \"9.20.3.7\"}, {\"status\": \"affected\", \"version\": \"9.19.1.37\"}, {\"status\": \"affected\", \"version\": \"9.20.3.9\"}, {\"status\": \"affected\", \"version\": \"9.19.1.38\"}, {\"status\": \"affected\", \"version\": \"9.18.4.50\"}, {\"status\": \"affected\", \"version\": \"9.22.1.2\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Cisco\", \"product\": \"Cisco Firepower Threat Defense Software\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.3.0\"}, {\"status\": \"affected\", \"version\": \"7.3.1\"}, {\"status\": \"affected\", \"version\": \"7.3.1.1\"}, {\"status\": \"affected\", \"version\": \"7.4.0\"}, {\"status\": \"affected\", \"version\": \"7.4.1\"}, {\"status\": \"affected\", \"version\": \"7.4.1.1\"}, {\"status\": \"affected\", \"version\": \"7.3.1.2\"}, {\"status\": \"affected\", \"version\": \"7.6.0\"}, {\"status\": \"affected\", \"version\": \"7.4.2\"}, {\"status\": \"affected\", \"version\": \"7.4.2.1\"}], \"defaultStatus\": \"unknown\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-acl-bypass-mtPze9Yh\", \"name\": \"cisco-sa-asa-ftd-acl-bypass-mtPze9Yh\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the implementation of access control rules for loopback interfaces in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should have been blocked to a loopback interface.\\r\\n\\r\\nThis vulnerability is due to improper enforcement of access control rules for loopback interfaces. An attacker could exploit this vulnerability by sending traffic to a loopback interface on an affected device. A successful exploit could allow the attacker to bypass configured access control rules and send traffic\u0026nbsp;that should have been blocked to a loopback interface on the device.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-284\", \"description\": \"Improper Access Control\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2025-08-14T16:28:40.010Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-20219\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-14T20:44:27.252Z\", \"dateReserved\": \"2024-10-10T19:15:13.233Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2025-08-14T16:28:40.010Z\", \"assignerShortName\": \"cisco\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…