CVE-2025-20333: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Critical severity · published Sep 25, 2025

CVE-2025-20333

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

In wildKEV

9.9

CVSS

71.2%

EPSS

Yes

On KEV

Description

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)71.2% · higher than 99% of CVEs

Exploited in the wildYes

CISA KEVListed Sep 25, 2025

Federal remediation dueSep 26, 2025

Ransomware campaign useNot known

Affected products

Which versions

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software · Cisco

9.8.1; 9.8.1.5; 9.8.1.7; 9.8.2; 9.8.2.8; 9.8.2.14; +34 more · source: vendor

Cisco Secure Firewall Threat Defense (FTD) Software · Cisco

6.2.3; 6.2.3.1; 6.2.3.2; 6.2.3.3; 6.2.3.4; 6.2.3.5; +34 more · source: vendor

Adaptive Security Appliance Software · Cisco

9.12 before 9.12.4.72; 9.14 before 9.14.4.28; 9.16 before 9.16.4.85; 9.17.0 before 9.17.1.45; 9.18 before 9.18.4.47; 9.19 before 9.19.1.37; +2 more · source: NVD

Secure Firewall Threat Defense · Cisco

7.0.0 before 7.0.8.1; 7.1.0 before 7.2.9; 7.3.0 before 7.4.2.4; 7.6.0 · source: NVD

Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense · Cisco

All versions, or not specified · source: KEV

In the news

VulnerabilityCritical

[CISA KEV] CVE-2025-20333: Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense - Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.

SFSecure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseCVE-2025-20333

Sep 25, 2025·CISA KEV

Affected product

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software

Cisco

All Cisco Secure Firewall Adaptive Security Appliance (ASA) Software CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-20333

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-20333

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

sec.cloudapps.cisco.com

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB

More from Cisco Secure Firewall Adaptive Security Appliance (ASA) Software

8.6

CVE-2026-20349

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability

8.6

CVE-2025-20362

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

9.9

CVE-2026-20332

Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Access Control Vulnerabilities

9.9

CVE-2026-20330

Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Neutralization Vulnerabilities

9.9

CVE-2026-20329

Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Exceptional Conditions Handling Vulnerabilities