BugZero | Cisco BugID CSCwn19639 - Cisco Secure Firewall Adaptive Security Appliance ...

Symptom

A vulnerability in the implementation of access control rules for loopback interfaces in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should have been blocked to a loopback interface. This vulnerability is due to improper enforcement of access control rules for loopback interfaces. An attacker could exploit this vulnerability by sending traffic to a loopback interface on an affected device. A successful exploit could allow the attacker to bypass configured access control rules and send traffic that should have been blocked to a loopback interface on the device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-acl-bypass-mtPze9Yh The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

Conditions

Please refer to the Security Advisory.

Workaround

Please refer to the Security Advisory.

Further Problem Description

Please refer to the Security Advisory.

PSIRT Evaluation

The Cisco PSIRT has assigned this bug the following CVSS version 3 score. The Base CVSS score as of the time of evaluation is 5.3: https://sec.cloudapps.cisco.com/security/center/cvssCalculator.x?vector=CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE ID CVE-2025-20219 has been assigned to document this issue. Information about Fixed, Vulnerable, and Non-vulnerable releases--as well as information about fixed release availability--is not maintained by Cisco PSIRT. Please refer to the appropriate fields in this bug. If you require additional help to obtain this information, please open a support case with your support organization. Additional information on Cisco's security vulnerability policy can be found at the following URL: https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html

Cisco - Defect ID: CSCwn19639

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control Rules Bypass Vulnerability

Cisco - Defect ID: CSCwn19639

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control Rules Bypass Vulnerability

Last updated on January 15th, 2026

BugZero Risk Score
6.1 Medium

Bug Details

Symptom

Conditions

Workaround

Further Problem Description

PSIRT Evaluation

Top Cisco Defects

Ready to prevent the next vendor outage?

Links

Cisco - Defect ID: CSCwn19639

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control Rules Bypass Vulnerability

Cisco - Defect ID: CSCwn19639

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control Rules Bypass Vulnerability

Last updated on January 15th, 2026

BugZero Risk Score6.1 Medium

Bug Details

Symptom

Conditions

Workaround

Further Problem Description

PSIRT Evaluation

Top Cisco Defects

Ready to prevent the next vendor outage?

Links

BugZero Risk Score
6.1 Medium