CVE-2025-20333

9.9

CRITICAL CVSS 3.1

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability - [Actively Exploited]

Description

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

INFO

Published Date :

Sept. 25, 2025, 4:15 p.m.

Last Modified :

Oct. 28, 2025, 1:58 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Sep 26, 2025

Alert Date: Sep 25, 2025 | 49 days ago

Description :

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.

Required Action :

The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Notes :

CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions ; https://www.cisa.gov/eviction-strategies-tool/create-from-template ; https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks ; https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB ; https://nvd.nist.gov/vuln/detail/CVE-2025-20333

Affected Products

The following products are affected by CVE-2025-20333 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Cisco	adaptive_security_appliance_software
2	Cisco	firepower_threat_defense

: Total Affected Vendor : 1 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]

Solution

Apply vendor patches to fix improper input validation and prevent code execution.

Update Cisco Secure Firewall ASA Software.
Update Cisco Secure Firewall FTD Software.
Apply vendor-provided security patches.
Restrict access to VPN web server.

Public PoC/Exploit Available at Github

CVE-2025-20333 has a 7 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-20333.

URL	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB	Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20333	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-20333 is associated with the following CWEs:

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-20333 weaknesses.

CAPEC-8: Buffer Overflow in an API Call Buffer Overflow in an API Call CAPEC-9: Buffer Overflow in Local Command-Line Utilities Buffer Overflow in Local Command-Line Utilities CAPEC-10: Buffer Overflow via Environment Variables Buffer Overflow via Environment Variables CAPEC-14: Client-side Injection-induced Buffer Overflow Client-side Injection-induced Buffer Overflow CAPEC-24: Filter Failure through Buffer Overflow Filter Failure through Buffer Overflow CAPEC-42: MIME Conversion MIME Conversion CAPEC-44: Overflow Binary Resource File Overflow Binary Resource File CAPEC-45: Buffer Overflow via Symbolic Links Buffer Overflow via Symbolic Links CAPEC-46: Overflow Variables and Tags Overflow Variables and Tags CAPEC-47: Buffer Overflow via Parameter Expansion Buffer Overflow via Parameter Expansion CAPEC-67: String Format Overflow in syslog() String Format Overflow in syslog() CAPEC-92: Forced Integer Overflow Forced Integer Overflow CAPEC-100: Overflow Buffers Overflow Buffers

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

iamthefrogy/Threat-Intel-Atlas

Your single pane of glass for threat intel: a clean, public feed that highlights high‑value security updates and trends.

Python JavaScript CSS HTML

Updated: 6 days, 3 hours ago

5 stars 0 fork 0 watcher

Born at : Nov. 2, 2025, 5:25 p.m. This repo has been linked 3 different CVEs too.

callinston/Cisco-ASA-FTD

None

Updated: 1 month ago

0 stars 0 fork 0 watcher

Born at : Oct. 8, 2025, 8:38 p.m. This repo has been linked 2 different CVEs too.

dataclean-saas/API---Hole

A diagnostic security platform that demonstrates the critical importance of timely security updates

HTML

Updated: 4 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : Sept. 28, 2025, 2:15 p.m. This repo has been linked 2 different CVEs too.

callinston/CVE-2025-20333

None

Updated: 1 month, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : Sept. 27, 2025, 7:52 p.m. This repo has been linked 1 different CVEs too.

abdulmyid-cyber/SIEM-Content

Zero Day SIgma rules

Updated: 4 weeks ago

0 stars 0 fork 0 watcher

Born at : Sept. 26, 2025, 6:28 p.m. This repo has been linked 3 different CVEs too.

frlc/frlc

None

Updated: 6 days, 17 hours ago

0 stars 0 fork 0 watcher

Born at : Dec. 7, 2023, 3:29 a.m. This repo has been linked 2 different CVEs too.

0xAtef/0xAtef

None

Updated: 6 days, 17 hours ago

0 stars 0 fork 0 watcher

Born at : Jan. 14, 2023, 11:38 a.m. This repo has been linked 2 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-20333 vulnerability anywhere in the article.

The Hacker News

CISA Flags Critical WatchGuard Fireware Flaw Exposing 54,000 Fireboxes to No-Login Attacks

Nov 13, 2025Ravie LakshmananVulnerability / Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting WatchGuard Firewar ...

Published Date: Nov 13, 2025 (2 hours, 33 minutes ago)

CybersecurityNews

CISA Warns of Federal Agencies Not Fully Patching Actively Exploited Cisco ASA or Firepower Devices

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding federal agencies. Failing to properly patch Cisco Adaptive Security Appliances (ASA) and Firepower Thr ...

Published Date: Nov 13, 2025 (2 hours, 37 minutes ago)

The Hacker News

Amazon Uncovers Attacks Exploited Cisco ISE and Citrix NetScaler as Zero-Day Flaws

Nov 12, 2025Ravie LakshmananNetwork Security / Zero-Day Amazon's threat intelligence team on Wednesday disclosed that it observed an advanced threat actor exploiting two then-zero-day security flaws ...

Published Date: Nov 12, 2025 (19 hours, 56 minutes ago)

The Hacker News

Hackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus Feature

Nov 10, 2025Ravie LakshmananVulnerability / Incident Response Google's Mandiant Threat Defense on Monday said it discovered n-day exploitation of a now-patched security flaw in Gladinet's Triofox fi ...

Published Date: Nov 10, 2025 (2 days, 13 hours ago)

security.nl

Kritieke kwetsbaarheid in Cisco-firewalls nu ook gebruikt voor dos-aanvallen

Een kritieke kwetsbaarheid in de software van Cisco wordt nu ook actief gebruikt voor het uitvoeren van dos-aanvallen tegen firewalls, zo laat de netwerkfabrikant weten. Eerder werd het beveiligingsle ...

Published Date: Nov 09, 2025 (3 days, 23 hours ago)

BleepingComputer

Cisco: Actively exploited firewall flaws now abused for DoS attacks

Cisco warned this week that two vulnerabilities, which have been used in zero-day attacks, are now being exploited to force ASA and FTD firewalls into reboot loops. The tech giant released security up ...

Published Date: Nov 07, 2025 (5 days, 18 hours ago)

The Register

Cisco warns of 'new attack variant' battering firewalls under exploit for 6 months

Cisco warned customers about another wave of attacks against its firewalls, which have been battered by intruders for at least six months. It also patched two critical bugs in its Unified Contact Cent ...

Published Date: Nov 06, 2025 (6 days, 15 hours ago)

The Hacker News

Cisco Warns of New Firewall Attack Exploiting CVE-2025-20333 and CVE-2025-20362

Nov 06, 2025Ravie LakshmananZero-Day / Vulnerability Cisco on Wednesday disclosed that it became aware of a new attack variant that's designed to target devices running Cisco Secure Firewall Adaptiv ...

Published Date: Nov 06, 2025 (6 days, 18 hours ago)

BleepingComputer

Critical Cisco UCCX flaw lets attackers run commands as root

Cisco has released security updates to patch a critical vulnerability in the Unified Contact Center Express (UCCX) software, which could enable attackers to execute commands with root privileges. The ...

Published Date: Nov 06, 2025 (6 days, 20 hours ago)

CybersecurityNews

Cisco Warns of Hackers Actively Exploiting ASA and FTD 0-day RCE Vulnerability in the Wild

Cisco has confirmed that threat actors are actively exploiting a critical remote code execution (RCE) flaw in its Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. F ...

Published Date: Nov 06, 2025 (1 week ago)

CybersecurityNews

Senate Investigates Cisco Over Zero-Day Firewall Vulnerabilities

U.S. Senator Bill Cassidy, Chairman of the Senate Health, Education, Labor, and Pensions (HELP) Committee, has demanded answers from Cisco Systems regarding recent zero-day vulnerabilities in its wide ...

Published Date: Oct 16, 2025 (3 weeks, 6 days ago)

The Register

Senator presses Cisco over firewall flaws that burned US agency

US Senator Bill Cassidy has fired off a pointed letter to Cisco over the firewall flaws that allegedly let hackers breach "at least one federal agency." Cassidy's letter [PDF] to Cisco CEO Chuck Robbi ...

Published Date: Oct 16, 2025 (3 weeks, 6 days ago)

security.nl

Amerikaanse senator wil meer informatie van Cisco over aangevallen lekken

De Amerikaanse senator Bill Cassidy wil dat Cisco meer informatie geeft over twee aangevallen kwetsbaarheden, zo blijkt uit een open brief aan Cisco-topman Chuck Robbins. Aanleiding voor het verzoek i ...

Published Date: Oct 16, 2025 (3 weeks, 6 days ago)

Daily CyberSecurity

Stealth C2: Hackers Abuse Discord Webhooks for Covert Data Exfiltration in npm, PyPI, and RubyGems Supply Chain Attacks

The Socket Threat Research Team has uncovered a growing trend among malicious package developers: leveraging Discord webhooks as command-and-control (C2) endpoints to exfiltrate sensitive data from de ...

Published Date: Oct 14, 2025 (4 weeks, 2 days ago)

Daily CyberSecurity

iPhone Fold Hinge Costs Drop to $70-$80, Boosting Viability for Mass Production in 2026

The long-rumored foldable iPhone — tentatively referred to as the iPhone Fold — has yet to be officially announced, but numerous reports have already surfaced detailing its production logistics and co ...

Published Date: Oct 14, 2025 (4 weeks, 2 days ago)

Daily CyberSecurity

Next-Gen AirPods: Apple Developing H3 Chip and Camera-Equipped Pro Model for Vision Pro Integration

With the official launch of AirPods Pro 3 last month, the market had widely anticipated that Apple would debut a next-generation audio chip in this model. Instead, the company opted to retain the H2 c ...