CVE-2025-20333: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: yes — in CISA KEV since 2025-09-25
EPSS: 71.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-25 · updated 2026-10-18
Weakness: CWE-120

Description

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

Summary

CVE-2025-20333 is a critical buffer overflow (CVSS 9.9) in the VPN web server of Cisco Secure Firewall ASA and FTD Software, caused by improper validation of user-supplied input in HTTP(S) requests. An authenticated remote attacker with valid VPN user credentials can send crafted HTTP requests to execute arbitrary code as root, potentially fully compromising the device. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS estimates a 71.2% probability of exploitation in 30 days. Affected users should upgrade to fixed ASA releases 9.12.4.72, 9.14.4.28, 9.16.4.85, or 9.17.1.45, or FTD releases 7.0.8.1, 7.2.9, or 7.4.2.4, and follow CISA mitigation guidance under Emergency Directive 25-03.

تُعدّ CVE-2025-20333 ثغرة تجاوز سعة المخزن المؤقت (buffer overflow) حرجة بدرجة CVSS 9.9 في خادم الويب الخاص بـ VPN في برمجيات Cisco Secure Firewall ASA وFTD، وتنتج عن التحقق غير السليم من المدخلات التي يوفّرها المستخدم في طلبات HTTP(S). يستطيع مهاجم بعيد ومصادَق عليه يملك بيانات اعتماد صالحة لمستخدم VPN إرسال طلبات HTTP مصمّمة لتنفيذ تعليمات برمجية عشوائية بصلاحيات root، مما قد يؤدي إلى اختراق الجهاز بالكامل. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة باستغلالها فعليًا، وتقدّر EPSS احتمال استغلالها خلال 30 يومًا بنسبة 71.2%. على المتأثرين الترقية إلى إصدارات ASA المُصلحة 9.12.4.72 أو 9.14.4.28 أو 9.16.4.85 أو 9.17.1.45، أو إصدارات FTD المُصلحة 7.0.8.1 أو 7.2.9 أو 7.4.2.4، واتباع إرشادات التخفيف من CISA ضمن التوجيه الطارئ ED 25-03.

Affected products

Cisco ASA Software: from 9.12 before 9.12.4.72; from 9.14 before 9.14.4.28; from 9.16 before 9.16.4.85; from 9.17.0 before 9.17.1.45; from 9.18 before 9.18.4.47; from 9.19 before 9.19.1.37 — fixed in 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.17.1.45, 9.18.4.47, 9.19.1.37
Cisco Firepower Threat Defense Software: from 7.0.0 before 7.0.8.1; from 7.1.0 before 7.2.9; from 7.3.0 before 7.4.2.4; 7.6.0 — fixed in 7.0.8.1, 7.2.9, 7.4.2.4

How to fix

Upgrade to a fixed version: Cisco ASA Software 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.17.1.45; Cisco Firepower Threat Defense Software 7.0.8.1, 7.2.9, 7.4.2.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-20333 or the next vulnerability affects your stack