CVE-2025-20333

View on CVE.org
Published Sep 25, 2025 CVSS 3.1 · 9.9 Critical EPSS 72.0% KEV · Listed
Description
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device.

This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-31140 A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.
History
Type Values Removed Values Added
First Time appeared Cisco secure Firewall Threat Defense
CPEs cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:7.6.0:*:*:*:*:*:*:*		 cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_firewall_threat_defense:7.6.0:*:*:*:*:*:*:*
Vendors & Products Cisco firepower Threat Defense
Cisco secure Firewall Threat Defense
Type Values Removed Values Added
First Time appeared Cisco firepower Threat Defense
CPEs cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:firepower_threat_defense:7.6.0:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
Vendors & Products Cisco firepower Threat Defense
Type Values Removed Values Added
First Time appeared Cisco
Cisco adaptive Security Appliance Software
Cisco firepower Threat Defense Software
Vendors & Products Cisco
Cisco adaptive Security Appliance Software
Cisco firepower Threat Defense Software
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics kev

{'dateAdded': '2025-09-25T00:00:00+00:00', 'dueDate': '2025-09-26T00:00:00+00:00'}
Type Values Removed Values Added
Description A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.
Weaknesses CWE-120
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}
Earlier changes (5)
Weaknesses

Sources

Status
PUBLISHED
Assigner
cisco
Published
Updated
Feb 26, 2026, 5:47 PM
Reserved
Oct 10, 2024, 7:15 PM

View source JSON

Updated
Sep 25, 2025, 5:04 PM

JSON

Status
Analyzed
Published
Sep 25, 2025, 4:15 PM
Modified
Oct 18, 2026, 9:10 PM

View source JSON

No data.

Updated
Sep 26, 2025, 11:35 AM

JSON