CVE-2025-20333
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability
Description
CVE-2025-20333 is a critical remote code execution vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The vulnerability allows an authenticated remote attacker with valid VPN user credentials to execute arbitrary code as root on the affected device by sending crafted HTTP requests. With a CVSS v3.1 base score of 9.9 and a changed scope, this represents one of the most severe Cisco firewall vulnerabilities, potentially leading to complete device takeover. CISA issued Emergency Directive 25-03 and added CVE-2025-20333 to the KEV catalog with an accelerated remediation deadline of September 26, 2025, and the EPSS score of 18.66% at the 95th percentile confirms substantial exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | adaptive security appliance software | >= 9.12, < 9.12.4.72; >= 9.14, < 9.14.4.28; >= 9.16, < 9.16.4.85; >= 9.17.0, < 9.17.1.45; >= 9.18, < 9.18.4.47; >= 9.19, < 9.19.1.37; >= 9.20, < 9.20.3.7; >= 9.22, < 9.22.1.3 |
| cisco | secure firewall threat defense | >= 7.0.0, < 7.0.8.1; >= 7.1.0, < 7.2.9; >= 7.3.0, < 7.4.2.4; 7.6.0 |
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB(Vendor Advisory)
- https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20333(US Government Resource)
Weakness Type
CWE-120: Buffer Copy without Checking Size of Input
CVE-2025-20333 is classified under CWE-120 (Buffer Copy without Checking Size of Input), commonly known as a classic buffer overflow. This weakness occurs when the software copies data from one buffer to another without verifying that the input data fits within the destination buffer. In the Cisco ASA and FTD VPN web server, user-supplied input in HTTP(S) requests is copied into a fixed-size buffer without proper bounds checking, allowing an attacker to overwrite adjacent memory and achieve code execution.
Learn more: CWE-120 — Buffer Copy without Checking Size of Input
Impact Analysis
CVE-2025-20333 carries a CVSS v3.1 base score of 9.9 (Critical severity), the highest practical score achievable with the low-privilege authentication requirement. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring only low-level VPN user credentials (PR:L) and no user interaction (UI:N). The changed scope (S:C) means that exploiting the VPN web server component grants access to the underlying operating system and all resources it controls. Confidentiality, integrity, and availability all face high impact because successful exploitation grants root-level code execution, allowing the attacker to read all configuration data and VPN traffic, modify firewall rules and device configurations, install persistent backdoors, and completely disable the device. The EPSS score of 18.66% at the 95th percentile indicates very high exploitation probability. Any organization using Cisco ASA or FTD as a VPN gateway faces the risk that a single compromised VPN user account could lead to complete firewall takeover and unfettered access to the protected network.
Exploit Maturity
CVE-2025-20333 represents a critical exploitation target, as confirmed by CISA's Emergency Directive 25-03 mandating immediate remediation for federal agencies. CISA has added this vulnerability to the KEV catalog, confirming active exploitation in the wild. The EPSS score of 18.66% at the 95th percentile indicates that exploitation is highly probable and places it among the top 5% of vulnerabilities by exploitation likelihood. Cisco has documented ongoing and evolving attack campaigns against ASA and FTD devices in their continued attacks resource page, providing additional threat intelligence. No public exploit code has been tagged in the available references, but the low barrier to exploitation — requiring only valid VPN credentials, which are frequently obtained through phishing or credential stuffing — combined with root-level code execution makes this an extremely attractive target for threat actors.
Remediation
-
Follow CISA Emergency Directive 25-03 and apply Cisco's patches immediately. For ASA Software, upgrade to fixed versions: 9.12.4.72+, 9.14.4.28+, 9.16.4.85+, 9.17.1.45+, 9.18.4.47+, 9.19.1.37+, 9.20.3.7+, or 9.22.1.3+ depending on your release train. For FTD Software, upgrade to: 7.0.8.1+, 7.2.9+, 7.4.2.4+, or a fixed release for the 7.6 train.
-
Review Cisco's security advisory at cisco-sa-asaftd-webvpn-z5xP8EUB for detailed upgrade paths, fixed release information, and indicators of compromise.
-
Enforce strong VPN authentication by implementing multi-factor authentication (MFA) for all VPN users. Since exploitation requires valid VPN credentials, MFA significantly raises the bar for attackers who have obtained passwords through credential stuffing or phishing.
-
Audit VPN user accounts for compromised credentials. Review VPN authentication logs for suspicious login patterns, unexpected geographic locations, or brute-force attempts. Disable or reset credentials for any accounts showing signs of compromise.
-
Conduct forensic analysis on ASA and FTD devices that were running vulnerable software while exposed to authenticated VPN users. Check for unauthorized configuration changes, unexpected processes, modified system files, or persistent access mechanisms. Root-level code execution means the attacker could have modified any component of the system.
Technical Details
CVE-2025-20333 is a buffer overflow vulnerability (CWE-120) in the VPN web server of Cisco ASA and FTD Software. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects a near-maximum severity score with full impact across confidentiality, integrity, and availability, combined with a scope change indicating system-level compromise. The vulnerability is triggered when an authenticated VPN user sends crafted HTTP(S) requests to the VPN web server component. The web server fails to properly validate the size of user-supplied input before copying it into a fixed-size buffer, resulting in a classic buffer overflow condition. By carefully crafting the overflow data, an attacker can overwrite control structures on the stack or heap to redirect program execution. Because the VPN web server process runs with elevated privileges on the underlying operating system, successful exploitation results in arbitrary code execution as root. This grants the attacker complete control over the ASA or FTD device, including the ability to modify firewall policies, intercept VPN traffic, install persistent backdoors, and pivot into the protected network.
Frequently Asked Questions
Is CVE-2025-20333 being actively exploited?
Yes. CISA has confirmed active exploitation and issued Emergency Directive 25-03 with an accelerated one-day remediation deadline. The EPSS score of 18.66% at the 95th percentile further confirms high exploitation probability against Cisco ASA and FTD devices.
What products are affected by CVE-2025-20333?
Cisco Secure Firewall ASA Software versions 9.12 through 9.22 and Cisco Secure Firewall Threat Defense (FTD) Software versions 7.0 through 7.6 are affected. Specific fixed versions are available for each release train in the Cisco advisory.
How do I fix CVE-2025-20333?
Upgrade Cisco ASA or FTD Software to the fixed releases specified in Cisco advisory cisco-sa-asaftd-webvpn-z5xP8EUB. Additionally, enforce multi-factor authentication for all VPN users and audit VPN accounts for signs of credential compromise.
How severe is CVE-2025-20333?
CVE-2025-20333 is rated Critical with a CVSS v3.1 base score of 9.9. Successful exploitation allows authenticated attackers to execute arbitrary code as root, enabling complete device takeover. The changed scope means the impact extends beyond the VPN component to the entire firewall and protected network.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.