CVE-2021-40125: Cisco Adaptive Security Appliance Software

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. This vulnerability is due to improper control of a resource. An attacker with the ability to spoof a trusted IKEv2 site-to-site VPN peer and in possession of valid IKEv2 credentials for that peer could exploit this vulnerability by sending malformed, authenticated IKEv2 messages to an affected device. A successful exploit could allow the attacker to trigger a reload of the device.

Affected products

• Cisco Adaptive Security Appliance Software: from 9.8.0, before 9.8.4.40 (fixed in 9.8.4.40); from 9.9.0, before 9.12.4.30 (fixed in 9.12.4.30); from 9.14.0, before 9.14.3.9 (fixed in 9.14.3.9); from 9.15.0, before 9.15.1.17 (fixed in 9.15.1.17); from 9.16.0, before 9.16.2 (fixed in 9.16.2)
• Cisco ASA 5505 Firmware: version 009.016(001.025) only
• Cisco ASA 5512-X Firmware: version 009.016(001.025) only
• Cisco ASA 5515-X Firmware: version 009.016(001.025) only
• Cisco ASA 5525-X Firmware: version 009.016(001.025) only
• Cisco ASA 5545-X Firmware: version 009.016(001.025) only
• Cisco ASA 5555-X Firmware: version 009.016(001.025) only
• Cisco ASA 5580 Firmware: version 009.016(001.025) only
• Cisco ASA 5585-X Firmware: version 009.016(001.025) only
• Cisco Secure Firewall Threat Defense: before 6.4.0.13 (fixed in 6.4.0.13); from 6.6.0, before 6.6.5 (fixed in 6.6.5); from 6.7.0, before 6.7.0.3 (fixed in 6.7.0.3); from 7.0.0, before 7.0.1 (fixed in 7.0.1)

Published 2021-10-27. Last modified 2026-08-11.