CVE-2025-20333

CRITICALCISA KEV

9.9

Description

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

Details CVE

Score CVSS v3.19.9

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurNONE

Publie9/25/2025

Derniere modification10/28/2025

Sourcekev

Observations honeypot0

CISA KEV

FournisseurCisco

ProduitSecure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense

Nom vulnerabiliteCisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Date ajout KEV2025-09-25

Date limite remediation2025-09-26

Utilise dans ransomwareUnknown

Produits affectes

cisco:adaptive_security_appliance_softwarecisco:firepower_threat_defense

Faiblesses (CWE)

CWE-120

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB(psirt@cisco.com)

https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20333(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.