Skip to content
Fencer Vulns
critical 9.9

CVE-2025-20333 kev in the critical feed json

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat…

published 2025-09-25 13 mo ago modified 2026-10-18 21 d ago also EUVD-2025-31140

cvss
9.9
version 3.1, CNA
cisa kev
Exploited
added 2025-09-25
epss
72.0%
EPSS 72.0% chance of exploitation in 30 days, percentile 99.4%
public exploits
0
none known

Summary

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

Patch / fix

cisa required action The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

  • cisco adaptive_security_appliance_software 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.17.1.45, 9.18.4.47, 9.19.1.37, 9.20.3.7, 9.22.1.3
  • cisco asa 9.12.4.72, 9.14.4.28, 9.16.4.85, 9.17.1.45, 9.18.4.47, 9.19.1.37, 9.20.3.7, 9.22.1.3
  • cisco firepower_threat_defense 7.0.8.1, 7.2.9, 7.4.2.4, 7.6.1
  • cisco ftd 7.0.8.1, 7.2.9, 7.4.2.4, 7.6.1

Timeline

  1. Added to CISA KEV
  2. Published
  3. CISA patch deadline
  4. CISA SSVC: exploitation active

Known exploited

Added
13 mo ago
Patch by
2025-09-26 (13 mo ago)
Ransomware
Not known
Required action
The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Vendor, product
Cisco, Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
CISA name
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
13 mo ago

Exploit prediction

72.04% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
  • Cisco Cisco Secure Firewall Threat Defense (FTD) Software

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.