Raw vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HSummary
CVE-2026-20025 is a medium-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Cisco Firepower Threat Defense Software. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9482
Vulnerability Data
A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. To exploit this vulnerability,…
more
the attacker must have the OSPF secret key. This vulnerability is due to insufficient input validation when processing OSPF link-state update (LSU) packets. An attacker could exploit this vulnerability by sending crafted OSPF LSU packets. A successful exploit could allow the attacker to corrupt the heap, causing the device to reload, resulting in a DoS condition.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables direct exploitation of the OSPF service on network devices to trigger heap corruption and device reload, matching Application or System Exploitation for DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly counters the root cause of insufficient input validation on crafted OSPF LSU packets that trigger integer overflow and heap corruption.
Limits the impact of the resulting denial-of-service condition by protecting the device against resource exhaustion from protocol packet floods.
Requires timely application of vendor patches that correct the OSPF LSU processing flaw in ASA/FTD software.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require use of safe arithmetic, bounds checks, and testing that prevent integer overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect integer overflows before release.
Secure SDLC mandates input validation and arithmetic checks that prevent integer overflows.
Application security requirements include bounds checking and safe arithmetic to avoid overflow conditions.
Secure architecture principles require defensive coding patterns that mitigate integer wraparound risks.
Secure coding standards explicitly forbid unsafe integer operations and mandate overflow-safe constructs.