CVE-2025-20333

State: Published
Severity: 9.9 Critical
Published: Sep 25, 2025
Updated: Feb 26, 2026
Reserved: Oct 10, 2024

Description

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

Scores

CVSS	Score	Vector	Source
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	cisco

Weaknesses

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected Products

Product	Versions
Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareCisco	9.8.1Affected 9.8.1.5Affected 9.8.1.7Affected 9.8.2Affected 9.8.2.8Affected 9.8.2.14Affected 9.8.2.15Affected 9.8.2.17Affected 9.8.2.20Affected 9.8.2.24Affected 9.8.2.26Affected 9.8.2.28Affected 9.8.2.33Affected 9.8.2.35Affected 9.8.2.38Affected 9.8.3.8Affected 9.8.3.11Affected 9.8.3.14Affected 9.8.3.16Affected 9.8.3.18Affected 9.8.3.21Affected 9.8.3Affected 9.8.3.26Affected 9.8.3.29Affected 9.8.4Affected and 181 more versions
Cisco Secure Firewall Threat Defense (FTD) SoftwareCisco	6.2.3Affected 6.2.3.1Affected 6.2.3.2Affected 6.2.3.3Affected 6.2.3.4Affected 6.2.3.5Affected 6.2.3.6Affected 6.2.3.7Affected 6.2.3.8Affected 6.2.3.10Affected 6.2.3.11Affected 6.2.3.9Affected 6.2.3.12Affected 6.2.3.13Affected 6.2.3.14Affected 6.2.3.15Affected 6.2.3.16Affected 6.2.3.17Affected 6.2.3.18Affected 6.6.0Affected 6.6.0.1Affected 6.6.1Affected 6.6.3Affected 6.6.4Affected 6.6.5Affected and 69 more versions

Product

Versions

Cisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareCisco

9.8.1Affected
9.8.1.5Affected
9.8.1.7Affected
9.8.2Affected
9.8.2.8Affected
9.8.2.14Affected
9.8.2.15Affected
9.8.2.17Affected
9.8.2.20Affected
9.8.2.24Affected
9.8.2.26Affected
9.8.2.28Affected
9.8.2.33Affected
9.8.2.35Affected
9.8.2.38Affected
9.8.3.8Affected
9.8.3.11Affected
9.8.3.14Affected
9.8.3.16Affected
9.8.3.18Affected
9.8.3.21Affected
9.8.3Affected
9.8.3.26Affected
9.8.3.29Affected
9.8.4Affected
and 181 more versions

Cisco Secure Firewall Threat Defense (FTD) SoftwareCisco

6.2.3Affected
6.2.3.1Affected
6.2.3.2Affected
6.2.3.3Affected
6.2.3.4Affected
6.2.3.5Affected
6.2.3.6Affected
6.2.3.7Affected
6.2.3.8Affected
6.2.3.10Affected
6.2.3.11Affected
6.2.3.9Affected
6.2.3.12Affected
6.2.3.13Affected
6.2.3.14Affected
6.2.3.15Affected
6.2.3.16Affected
6.2.3.17Affected
6.2.3.18Affected
6.6.0Affected
6.6.0.1Affected
6.6.1Affected
6.6.3Affected
6.6.4Affected
6.6.5Affected
and 69 more versions

References

cisco-sa-asaftd-webvpn-z5xP8EUB
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacksvendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20333government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.