CVE-2025-20268
published 2025-08-14CVE-2025-20268: A vulnerability in the Geolocation-Based Remote Access (RA) VPN feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated…
PriorityP337medium5.8CVSS 3.1
AVNACLPRNUINSCCNILAN
EPSS
0.48%
38.8th percentile
A vulnerability in the Geolocation-Based Remote Access (RA) VPN feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies to allow or deny HTTP connections based on a country or region.
This vulnerability exists because the URL string is not fully parsed. An attacker could exploit this vulnerability by sending a crafted HTTP connection through the targeted device. A successful exploit could allow the attacker to bypass configured policies and gain access to a network where the connection should have been denied.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_firepower_threat_defense_software | — | — |
| cisco | secure_firewall_threat_defense | — | — |
CVSS provenance
nvdv3.15.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
vendor_cisco5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Secure Firewall Threat Defense Software Geolocation Remote Access VPN Bypass Vulnerability
vendor_cisco·2025-08-14·CVSS 5.8
CVE-2025-20268 [MEDIUM] CWE-229 Cisco Secure Firewall Threat Defense Software Geolocation Remote Access VPN Bypass Vulnerability
Cisco Secure Firewall Threat Defense Software Geolocation Remote Access VPN Bypass Vulnerability
A vulnerability in the Geolocation-Based Remote Access (RA) VPN feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies to allow or deny HTTP connections based on a country or region.
This vulnerability exists because the URL string is not fully parsed. An attacker could exploit this vulnerability by sending a crafted HTTP connection through the targeted device. A successful exploit could allow the attacker to bypass configured policies and gain access to a network where the connection should have been denied.
Cisco has released software updates that address this vulnerability. There are no workarounds that
Cisco
Cisco Secure Firewall Threat Defense Software Geolocation Remote Access VPN Bypass Vulnerability
vendor_cisco·CVSS 3.1
CVE-2025-20268 Cisco Secure Firewall Threat Defense Software Geolocation Remote Access VPN Bypass Vulnerability
CVE-2025-20268: Cisco Secure Firewall Threat Defense Software Geolocation Remote Access VPN Bypass Vulnerability
A vulnerability in the Geolocation-Based Remote Access (RA) VPN feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies to allow or deny HTTP connections based on a country or region. This vulnerability exists because the URL string is not fully parsed. An attacker could exploit this vulnerability by sending a crafted HTTP connection through the targeted device. A successful exploit could allow the attacker to bypass configured policies and gain access to a network where the connection should have been denied. Cisco has released software updates that address this vulnerability. There are no
CVSS
GHSA
GHSA-6f5f-5ghv-m9h2: A vulnerability in the Geolocation-Based Remote Access (RA) VPN feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthen
ghsa_unreviewed·2025-08-14
CVE-2025-20268 [MEDIUM] CWE-229 GHSA-6f5f-5ghv-m9h2: A vulnerability in the Geolocation-Based Remote Access (RA) VPN feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthen
A vulnerability in the Geolocation-Based Remote Access (RA) VPN feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies to allow or deny HTTP connections based on a country or region.
This vulnerability exists because the URL string is not fully parsed. An attacker could exploit this vulnerability by sending a crafted HTTP connection through the targeted device. A successful exploit could allow the attacker to bypass configured policies and gain access to a network where the connection should have been denied.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-08-14
Published