1. Home
  2. Vulnerabilities
  3. CVE-2025-20333
Known Exploited Vulnerability
9.9
CRITICAL CVSS 3.1
CVE-2025-20333
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability - [Actively Exploited]
Description

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

INFO

Published Date :

Sept. 25, 2025, 4:15 p.m.

Last Modified :

Sept. 26, 2025, 2:08 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.

Required Action :

The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Notes :

CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions ; https://www.cisa.gov/eviction-strategies-tool/create-from-template ; https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks ; https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB ; https://nvd.nist.gov/vuln/detail/CVE-2025-20333

Affected Products

The following products are affected by CVE-2025-20333 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Cisco adaptive_security_appliance_software
2 Cisco firepower_threat_defense
: Total Affected Vendor : 1 | Products : 2
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL [email protected]
Solution
Apply vendor patches to fix improper input validation and prevent code execution.
  • Update Cisco Secure Firewall ASA Software.
  • Update Cisco Secure Firewall FTD Software.
  • Apply vendor-provided security patches.
  • Restrict access to VPN web server.
Public PoC/Exploit Available at Github

CVE-2025-20333 has a 4 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-20333.

URL Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks Vendor Advisory
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-20333 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-20333 weaknesses.

CAPEC-8: Buffer Overflow in an API Call Buffer Overflow in an API Call CAPEC-9: Buffer Overflow in Local Command-Line Utilities Buffer Overflow in Local Command-Line Utilities CAPEC-10: Buffer Overflow via Environment Variables Buffer Overflow via Environment Variables CAPEC-14: Client-side Injection-induced Buffer Overflow Client-side Injection-induced Buffer Overflow CAPEC-24: Filter Failure through Buffer Overflow Filter Failure through Buffer Overflow CAPEC-42: MIME Conversion MIME Conversion CAPEC-44: Overflow Binary Resource File Overflow Binary Resource File CAPEC-45: Buffer Overflow via Symbolic Links Buffer Overflow via Symbolic Links CAPEC-46: Overflow Variables and Tags Overflow Variables and Tags CAPEC-47: Buffer Overflow via Parameter Expansion Buffer Overflow via Parameter Expansion CAPEC-67: String Format Overflow in syslog() String Format Overflow in syslog() CAPEC-92: Forced Integer Overflow Forced Integer Overflow CAPEC-100: Overflow Buffers Overflow Buffers

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
callinston/Cisco-ASA-FTD

None

Updated: 1 week ago
0 stars 0 fork 0 watcher
Born at : Oct. 8, 2025, 8:38 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
dataclean-saas/API---Hole

A diagnostic security platform that demonstrates the critical importance of timely security updates

HTML

Updated: 2 days, 8 hours ago
0 stars 0 fork 0 watcher
Born at : Sept. 28, 2025, 2:15 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
callinston/CVE-2025-20333

None

Updated: 2 weeks, 4 days ago
0 stars 0 fork 0 watcher
Born at : Sept. 27, 2025, 7:52 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
abdulmyid-cyber/SIEM-Content

Zero Day SIgma rules

Updated: 1 day, 2 hours ago
0 stars 0 fork 0 watcher
Born at : Sept. 26, 2025, 6:28 p.m. This repo has been linked 3 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-20333 vulnerability anywhere in the article.

  • CybersecurityNews
Senate Investigates Cisco Over Zero-Day Firewall Vulnerabilities

U.S. Senator Bill Cassidy, Chairman of the Senate Health, Education, Labor, and Pensions (HELP) Committee, has demanded answers from Cisco Systems regarding recent zero-day vulnerabilities in its wide ... Read more

Published Date: Oct 16, 2025 (4 hours, 56 minutes ago)
  • The Register
Senator presses Cisco over firewall flaws that burned US agency

US Senator Bill Cassidy has fired off a pointed letter to Cisco over the firewall flaws that allegedly let hackers breach "at least one federal agency." Cassidy's letter [PDF] to Cisco CEO Chuck Robbi ... Read more

Published Date: Oct 16, 2025 (5 hours, 50 minutes ago)
  • security.nl
Amerikaanse senator wil meer informatie van Cisco over aangevallen lekken

De Amerikaanse senator Bill Cassidy wil dat Cisco meer informatie geeft over twee aangevallen kwetsbaarheden, zo blijkt uit een open brief aan Cisco-topman Chuck Robbins. Aanleiding voor het verzoek i ... Read more

Published Date: Oct 16, 2025 (8 hours, 11 minutes ago)
  • Daily CyberSecurity
Stealth C2: Hackers Abuse Discord Webhooks for Covert Data Exfiltration in npm, PyPI, and RubyGems Supply Chain Attacks

The Socket Threat Research Team has uncovered a growing trend among malicious package developers: leveraging Discord webhooks as command-and-control (C2) endpoints to exfiltrate sensitive data from de ... Read more

Published Date: Oct 14, 2025 (2 days, 18 hours ago)
  • Daily CyberSecurity
iPhone Fold Hinge Costs Drop to $70-$80, Boosting Viability for Mass Production in 2026

The long-rumored foldable iPhone — tentatively referred to as the iPhone Fold — has yet to be officially announced, but numerous reports have already surfaced detailing its production logistics and co ... Read more

Published Date: Oct 14, 2025 (2 days, 18 hours ago)
  • Daily CyberSecurity
Next-Gen AirPods: Apple Developing H3 Chip and Camera-Equipped Pro Model for Vision Pro Integration

With the official launch of AirPods Pro 3 last month, the market had widely anticipated that Apple would debut a next-generation audio chip in this model. Instead, the company opted to retain the H2 c ... Read more

Published Date: Oct 13, 2025 (3 days, 10 hours ago)
  • Daily CyberSecurity
Oracle Warns of Unauthenticated Vulnerability in E-Business Suite (CVE-2025-61884)

Oracle has issued an emergency Security Alert Advisory for a newly discovered vulnerability affecting Oracle E-Business Suite, tracked as CVE-2025-61884. The flaw, which carries a critical remote expl ... Read more

Published Date: Oct 13, 2025 (3 days, 16 hours ago)
  • Daily CyberSecurity
Pro-Russian Hacktivist Group TwoNet Exposed for Fabricating Critical Infrastructure Attacks to Boost Reputation

Forescout Research has uncovered a disturbing new tactic among pro-Russian hacktivists — fabricating real-world critical infrastructure attacks to inflate their reputation. In a recent case, a newly f ... Read more

Published Date: Oct 13, 2025 (3 days, 17 hours ago)
  • Daily CyberSecurity
Critical Cherry Studio Flaw CVE-2025-61929 (CVSS 9.7) Allows One-Click RCE via Custom URL Protocol

A critical security flaw has been discovered in Cherry Studio, a cross-platform desktop client that supports multiple large language model (LLM) providers. Tracked as CVE-2025-61929 and rated CVSS 9.7 ... Read more

Published Date: Oct 13, 2025 (3 days, 17 hours ago)
  • Daily CyberSecurity
Critical Auth Bypass (CVE-2025-61928) in Better Auth Allows Hackers to Steal User API Keys

A critical authentication bypass vulnerability has been discovered in Better Auth, a popular framework-agnostic authentication and authorization library for TypeScript, used by developers to add secur ... Read more

Published Date: Oct 13, 2025 (3 days, 18 hours ago)
  • Daily CyberSecurity
Axis Communications Leaks Azure Credentials in Autodesk Plugin Via Hardcoded SAS Tokens

Trend Micro’s Threat Research team has uncovered a serious cloud credential exposure involving Axis Communications, a leading provider of network surveillance and security devices. The issue originate ... Read more

Published Date: Oct 13, 2025 (3 days, 18 hours ago)
  • Daily CyberSecurity
Massive RDP Botnet Unleashed: 100,000+ IPs in Coordinated Global Scanning Campaign Targeting US

GreyNoise Intelligence has issued an alert about a massive coordinated botnet operation targeting Remote Desktop Protocol (RDP) services across the United States. Since October 8, 2025, researchers ha ... Read more

Published Date: Oct 13, 2025 (3 days, 18 hours ago)
  • Daily CyberSecurity
Akira Ransomware Revives SonicWall Flaw CVE-2024-40766, Uses ‘UnPAC the Hash’ to Breach Networks

Image: Fortinet Between July and August 2025, global security teams have observed a resurgence in Akira ransomware incidents targeting organizations through SonicWall SSL VPN appliances, marking a ren ... Read more

Published Date: Oct 13, 2025 (3 days, 18 hours ago)
  • Daily CyberSecurity
China Launches Antitrust Probe into Qualcomm Over Autotalks Acquisition Failure to File Declaration

China’s State Administration for Market Regulation (SAMR) recently announced the launch of an antitrust investigation into U.S. chipmaker Qualcomm, citing the company’s failure to file a mandatory “op ... Read more

Published Date: Oct 11, 2025 (5 days, 10 hours ago)
  • Daily CyberSecurity
Gemini Nano Block: Google Locks On-Device AI Access for Smartphones with Unlocked Bootloaders

For certain advanced users and developers, unlocking the Android operating system on their smartphones is a common practice. Once unlocked, it grants elevated privileges and access to deeper system fu ... Read more

Published Date: Oct 10, 2025 (6 days, 15 hours ago)
  • Daily CyberSecurity
CL0P Extortion: Google/Mandiant Expose Zero-Day RCE in Oracle E-Business Suite (CVE-2025-61882)

Google Threat Intelligence Group (GTIG) and Mandiant have jointly disclosed an extensive data theft and extortion campaign targeting Oracle E-Business Suite (EBS) environments, linked to threat actors ... Read more

Published Date: Oct 10, 2025 (6 days, 15 hours ago)
  • Daily CyberSecurity
Exploited Zero-Day: Gladinet/Triofox Flaw CVE-2025-11371 Allows RCE via LFI

Huntress has sounded the alarm over active exploitation of a newly discovered Local File Inclusion (LFI) vulnerability in Gladinet CentreStack and Triofox software, tracked as CVE-2025-11371 (CVSS 6.1 ... Read more

Published Date: Oct 10, 2025 (6 days, 15 hours ago)
  • Daily CyberSecurity
RondoDox Botnet Unleashed: New Malware Uses ‘Exploit Shotgun’ to Target 50+ Router and IoT Flaws

Trend Micro has uncovered a rapidly expanding botnet campaign dubbed RondoDox, which is targeting a wide spectrum of internet-exposed devices — from routers and DVRs to CCTV systems and industrial net ... Read more

Published Date: Oct 10, 2025 (6 days, 16 hours ago)
  • Daily CyberSecurity
DFIR Tool Hijacked: Ransomware Group Storm-2603 Abuses Velociraptor for Stealthy LockBit/Babuk Attacks

Cisco Talos has confirmed that ransomware operators are now abusing Velociraptor, an open-source digital forensics and incident response (DFIR) tool, in live ransomware campaigns. “Ransomware operator ... Read more

Published Date: Oct 10, 2025 (6 days, 16 hours ago)
  • Daily CyberSecurity
ClickFix Phishing: New Automated Kits Trick Users Into Manually Running Malware and Stealers

Researchers from Palo Alto Networks Unit 42 have discovered a new phishing trend where attackers trick victims into manually executing malware on their own devices. The report exposes a commoditized p ... Read more

Published Date: Oct 10, 2025 (6 days, 18 hours ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2025-20333 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Sep. 26, 2025

    Action Type Old Value New Value
    Added CPE Configuration OR *cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* versions from (including) 9.12 up to (excluding) 9.12.4.72 *cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* versions from (including) 9.14 up to (excluding) 9.14.4.28 *cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* versions from (including) 9.16 up to (excluding) 9.16.4.85 *cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* versions from (including) 9.17.0 up to (excluding) 9.17.1.45 *cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* versions from (including) 9.18 up to (excluding) 9.18.4.47 *cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* versions from (including) 9.19 up to (excluding) 9.19.1.37 *cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* versions from (including) 9.20 up to (excluding) 9.20.3.7 *cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* versions from (including) 9.22 up to (excluding) 9.22.1.3
    Added CPE Configuration OR *cpe:2.3:a:cisco:firepower_threat_defense:7.6.0:*:*:*:*:*:*:* *cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* versions from (including) 7.0.0 up to (excluding) 7.0.8.1 *cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* versions from (including) 7.1.0 up to (excluding) 7.2.9 *cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:* versions from (including) 7.3.0 up to (excluding) 7.4.2.4
    Added Reference Type Cisco Systems, Inc.: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB Types: Vendor Advisory
    Added Reference Type CISA-ADP: https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks Types: Vendor Advisory
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Sep. 26, 2025

    Action Type Old Value New Value
    Added Date Added 2025-09-25
    Added Due Date 2025-09-26
    Added Vulnerability Name Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability
    Added Required Action The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Sep. 25, 2025

    Action Type Old Value New Value
    Added Reference https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
  • New CVE Received by [email protected]

    Sep. 25, 2025

    Action Type Old Value New Value
    Added Description A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.
    Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    Added CWE CWE-120
    Added Reference https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 9.9
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact