Servers and applications
CVE-2025-20333
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials…
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 25 Sept 2025.
- Severity
- Critical 9.9
- Published
- 25 Sept 2025
- Last changed
- 18 Oct 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 9.16.4.85, 9.17.1.45, 9.18.4.47, 9.19.1.37, 9.20.3.7, 9.22.1.3
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Cisco ASA and Firepower Threat DefenseServers and applications · cpe:o:cisco:adaptive_security_appliance_software |
All 8 release lines
|
Known exploited
- CISA name
- Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability
- Required action
- The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s…
- Due for US agencies
- 26 Sept 2025
- Used in ransomware
- Not known