CVE-2025-20363

9.0

CRITICAL CVSS 3.1

"Cisco Secure Firewall Arbitrary Code Execution Vulnerability"

Description

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.

INFO

Published Date :

Sept. 25, 2025, 4:15 p.m.

Last Modified :

Sept. 29, 2025, 2 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

Affected Products

The following products are affected by CVE-2025-20363 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Cisco	ios_xe
2	Cisco	ios
3	Cisco	adaptive_security_appliance_software
4	Cisco	firepower_threat_defense
5	Cisco	ios_xr

: Total Affected Vendor : 1 | Products : 5

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]

Solution

Apply vendor-supplied updates to mitigate arbitrary code execution risk.

Update Cisco Secure Firewall ASA and FTD software.
Update Cisco IOS, IOS XE, and IOS XR software.
Restrict access to affected web services.
Monitor systems for suspicious activity.

Public PoC/Exploit Available at Github

CVE-2025-20363 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-20363.

URL	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O	Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-20363 is associated with the following CWEs:

CWE-122: Heap-based Buffer Overflow

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-20363 weaknesses.

CAPEC-92: Forced Integer Overflow Forced Integer Overflow

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

rjb4standards/VDRproposal

Vulnerability Disclosure Report (VDR) Proposed Standard

Python

Updated: 1 day, 4 hours ago

0 stars 0 fork 0 watcher

Born at : Oct. 12, 2025, 12:13 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-20363 vulnerability anywhere in the article.

Daily CyberSecurity

Samsung Sets Oct 21 Event to Unveil “Project Moohan,” Its Android XR Headset Rival to Vision Pro

Samsung data breach Samsung has announced that it will host a new product unveiling event titled “Worlds Wide Open” on October 21 at 10 p.m. Eastern Time. The company revealed that the event will show ...

Published Date: Oct 15, 2025 (1 day, 16 hours ago)

CybersecurityNews

Cisco ASA/FTD 0-Day Vulnerability Exploited for Authentication Bypass – PoC Released

Cisco has released advisories for a zero-day exploit chain affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software, which is reportedly being ...

Published Date: Oct 07, 2025 (1 week, 2 days ago)

TheCyberThrone

500X Surge in Scanning Targets Palo Alto and Cisco ASA

October 4, 2025Enterprise security teams are on high alert after an extraordinary 500% spike in mass scanning activity was detected against Palo Alto Networks and Cisco ASA firewall platforms. Over th ...

Published Date: Oct 04, 2025 (1 week, 5 days ago)

CybersecurityNews

Lesson From Cisco ASA 0-Day RCE Vulnerability That Actively Exploited In The Wild

The cybersecurity landscape experienced a significant escalation in September 2025, when Cisco disclosed multiple critical zero-day vulnerabilities affecting its Adaptive Security Appliance (ASA) and ...

Published Date: Sep 29, 2025 (2 weeks, 3 days ago)

TheCyberThrone

Critical Cisco SSL VPN Vulnerabilities

September 26, 2025The cybersecurity world is on alert after multiple critical vulnerabilities were discovered in Cisco SSL VPN solutions, specifically affecting Cisco ASA and FTD platforms. These flaw ...