CVE-2025-20333

9.9

CRITICAL CVSS 3.1

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability - [Actively Exploited]

Description

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

INFO

Published Date :

Sept. 25, 2025, 4:15 p.m.

Last Modified :

Oct. 28, 2025, 1:58 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Sep 26, 2025

Alert Date: Sep 25, 2025 | 69 days ago

Description :

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.

Required Action :

The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Notes :

CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions ; https://www.cisa.gov/eviction-strategies-tool/create-from-template ; https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks ; https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB ; https://nvd.nist.gov/vuln/detail/CVE-2025-20333

Affected Products

The following products are affected by CVE-2025-20333 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Cisco	adaptive_security_appliance_software
2	Cisco	firepower_threat_defense

: Total Affected Vendor : 1 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]

Solution

Apply vendor patches to fix improper input validation and prevent code execution.

Update Cisco Secure Firewall ASA Software.
Update Cisco Secure Firewall FTD Software.
Apply vendor-provided security patches.
Restrict access to VPN web server.

Public PoC/Exploit Available at Github

CVE-2025-20333 has a 4 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-20333.

URL	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB	Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20333	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-20333 is associated with the following CWEs:

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-20333 weaknesses.

CAPEC-8: Buffer Overflow in an API Call Buffer Overflow in an API Call CAPEC-9: Buffer Overflow in Local Command-Line Utilities Buffer Overflow in Local Command-Line Utilities CAPEC-10: Buffer Overflow via Environment Variables Buffer Overflow via Environment Variables CAPEC-14: Client-side Injection-induced Buffer Overflow Client-side Injection-induced Buffer Overflow CAPEC-24: Filter Failure through Buffer Overflow Filter Failure through Buffer Overflow CAPEC-42: MIME Conversion MIME Conversion CAPEC-44: Overflow Binary Resource File Overflow Binary Resource File CAPEC-45: Buffer Overflow via Symbolic Links Buffer Overflow via Symbolic Links CAPEC-46: Overflow Variables and Tags Overflow Variables and Tags CAPEC-47: Buffer Overflow via Parameter Expansion Buffer Overflow via Parameter Expansion CAPEC-67: String Format Overflow in syslog() String Format Overflow in syslog() CAPEC-92: Forced Integer Overflow Forced Integer Overflow CAPEC-100: Overflow Buffers Overflow Buffers

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

callinston/Cisco-ASA-FTD

None

Updated: 1 month, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : Oct. 8, 2025, 8:38 p.m. This repo has been linked 2 different CVEs too.

dataclean-saas/API---Hole

A diagnostic security platform that demonstrates the critical importance of timely security updates

HTML

Updated: 1 month, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : Sept. 28, 2025, 2:15 p.m. This repo has been linked 2 different CVEs too.

callinston/CVE-2025-20333

None

Updated: 2 months ago

0 stars 0 fork 0 watcher

Born at : Sept. 27, 2025, 7:52 p.m. This repo has been linked 1 different CVEs too.

abdulmyid-cyber/SIEM-Content

Zero Day SIgma rules

Updated: 1 month, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : Sept. 26, 2025, 6:28 p.m. This repo has been linked 3 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-20333 vulnerability anywhere in the article.

europa.eu

Cyber Brief 25-12 - November 2025

Cyber Brief (November 2025)December 2, 2025 - Version: 1TLP:CLEARExecutive summaryWe analysed 277 open source reports for this Cyber Security Brief1.Relating to cyber policy and law enforcement, Opera ...

Published Date: Dec 02, 2025 (1 day, 4 hours ago)

The Cyber Express

Airbus Nears Completion of A320 Retrofit as Regulators Monitor Largest Emergency Recall in Company History

Airbus has entered the final phase of its unprecedented global retrofit effort, confirming that fewer than 100 A320s in service still require updates after the discovery of a software vulnerability th ...

Published Date: Dec 01, 2025 (2 days, 7 hours ago)

The Cyber Express

Stolen VPN Credentials Most Common Ransomware Attack Vector

Compromised VPN credentials are the most common initial access vector for ransomware attacks, according to a new report. Nearly half of ransomware attacks in the third quarter abused compromised VPN c ...

Published Date: Nov 20, 2025 (1 week, 6 days ago)

Help Net Security

Week in review: Windows kernel flaw patched, suspected Fortinet FortiWeb zero-day exploited

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Adopting a counterintelligence mindset in luxury logistics In this Help Net Security interview, Andrea ...

Published Date: Nov 16, 2025 (2 weeks, 3 days ago)

The Hacker News

RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet

Nov 15, 2025Ravie LakshmananMalware / Vulnerability The botnet malware known as RondoDox has been observed targeting unpatched XWiki instances against a critical security flaw that could allow attac ...

Published Date: Nov 15, 2025 (2 weeks, 4 days ago)

hackread.com

CISA Warns of Active Attacks on Cisco ASA and Firepower Flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a strong warning regarding critical vulnerabilities in Cisco’s Adaptive Security Appliances (ASA) and Firepower devices, which ...

Published Date: Nov 14, 2025 (2 weeks, 5 days ago)

The Cyber Express

Akira Ransomware Group Poses ‘Imminent Threat’ to Critical Infrastructure: CISA

The Akira ransomware group poses an “imminent threat to critical infrastructure,” the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned today. CISA joined with the FBI, other U.S. ag ...