CVE-2025-20333

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-20333
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

9.9 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20333 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_firewall_threat_defense:7.6.0:*:*:*:*:*:*:*
History

18 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad en el servidor web VPN de Cisco Secure Firewall Adaptive Security Appliance (ASA) Software y Cisco Secure Firewall Threat Defense (FTD) Software podría permitir a un atacante remoto autenticado ejecutar código arbitrario en un dispositivo afectado. Esta vulnerabilidad se debe a una validación incorrecta de la entrada proporcionada por el usuario en las solicitudes HTTP(S). Un atacante con credenciales de usuario VPN válidas podría explotar esta vulnerabilidad enviando solicitudes HTTP manipuladas a un dispositivo afectado. Un exploit exitoso podría permitir al atacante ejecutar código arbitrario como root, lo que posiblemente resultaría en el compromiso completo del dispositivo afectado.
Information

Published : 2025-09-25 16:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-20333

Mitre link : CVE-2025-20333

CVE.ORG link : CVE-2025-20333

JSON object : View

Products Affected

cisco

  • secure_firewall_threat_defense
  • adaptive_security_appliance_software
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')