Critical severity9.9CISA KEVNVD Advisory· Published Sep 25, 2025· Updated Aug 11, 2026
CVE-2025-20333
CVE-2025-20333
Description
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*range: >=7.0.0,<7.0.8.1
- cpe:2.3:a:cisco:secure_firewall_threat_defense:7.6.0:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*range: >=9.12,<9.12.4.72
- (no CPE)
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 6.2.3
- Range: 9.8.1
Patches
Vulnerability mechanics
References
3- sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUBnvdVendor Advisory
- sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacksnvdVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
7- Russian Threat Groups Use RDP, VPN, Supply Chain Attacks, and Social Engineering for Initial AccessCyber Security News · May 22, 2026
- New Cisco DoS flaw requires manual reboot to revive devicesBleepingComputer · May 6, 2026
- ⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & MoreThe Hacker News · Apr 27, 2026
- FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security PatchesThe Hacker News · Apr 24, 2026
- It pays to be a forever studentCisco Talos Intelligence · Apr 23, 2026
- UAT-4356's Targeting of Cisco Firepower DevicesCisco Talos Intelligence · Apr 23, 2026
- FIRESTARTER BackdoorCISA Alerts