CVE-2025-20333: Cisco ASA and FTD buffer overflow in VPN web server

CVE-2025-20333 · Severity: critical · CVSS 9.9 · Exploited in the wild · Published 2025-09-25

Cisco Secure Firewall appliances, which are used to protect corporate networks and provide secure remote access (VPN), contain a critical security flaw. An attacker with valid VPN credentials can exploit this vulnerability to take full control of the firewall device. This could lead to a complete network compromise, data theft, or a total shutdown of secure remote access services.

Technologies: Cisco Adaptive Security Appliance Software, Cisco Secure Firewall Adaptive Security Appliance, Cisco Secure Firewall Threat Defense, Cisco Secure Firewall Threat Defense Software. Vendors: Cisco.

Quick answers

Is CVE-2025-20333 exploited in the wild?
Yes. CVE-2025-20333 is known to be exploited in the wild, first recorded on 25 September 2025. Treat it as urgent.
How severe is CVE-2025-20333?
Critical severity, with a CVSS score of 9.9, published 25 September 2025.
Which products and versions are affected?
Cisco Adaptive Security Appliance (ASA) Software 9.12 through 9.22.1.3 (specific ranges apply); Cisco Secure Firewall Threat Defense (FTD) Software 7.0.0 through 7.6.0 (specific ranges apply).
Is there a fix for CVE-2025-20333?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-20333 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-20333?
Check whether you run Cisco Adaptive Security Appliance Software, Cisco Secure Firewall Adaptive Security Appliance, Cisco Secure Firewall Threat Defense or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in the VPN web server component of Cisco ASA and FTD software due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials can exploit this by sending crafted HTTP requests to the affected device. Successful exploitation allows for remote code execution (RCE) as the root user, leading to full system compromise. This vulnerability is notable for being exploited in the wild and can be chained with other vulnerabilities like CVE-2025-20362. Cisco has released software updates to address these issues.

Affected products

  • Cisco Adaptive Security Appliance (ASA) Software 9.12 through 9.22.1.3 (specific ranges apply)
  • Cisco Secure Firewall Threat Defense (FTD) Software 7.0.0 through 7.6.0 (specific ranges apply)

Timeline

  • 2025-09-25: disclosed
  • 2025-09-25: advisory
  • 2025-09-25: kev added: Added to CISA KEV due to active exploitation.
  • 2025-09-25: exploited

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.