CVE-2025-20333: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability (Pentest Lab Guide)

CVE-2025-20333: Technical Deep-Dive (Auto Refreshed)

Generated on 2026-03-23T21:24:52.015Z. This file is automatically regenerated every 30 minutes by the CVE AI enrichment job using web sources (NVD, MITRE, CISA KEV, GitHub).

Executive Technical Summary

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

Context preserved from previous revision: A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device. 1. Use only isolated environments and systems you own or are explicitly authorized to test.

Technical Details

CVE: CVE-2025-20333
KEV date added: Unknown
KEV due date: Not specified
NVD published: 2025-09-25
NVD modified: 2025-10-28
MITRE modified: 2026-02-26
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS exploitability score: 3.1
CVSS impact score: 6
Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Changed
Confidentiality impact: High
Integrity impact: High
Availability impact: High

Versions and Products Impacted

cisco / adaptive security appliance software (versions: >= 9.12, < 9.12.4.72)
cisco / adaptive security appliance software (versions: >= 9.14, < 9.14.4.28)
cisco / adaptive security appliance software (versions: >= 9.16, < 9.16.4.85)
cisco / adaptive security appliance software (versions: >= 9.17.0, < 9.17.1.45)
cisco / adaptive security appliance software (versions: >= 9.18, < 9.18.4.47)
cisco / adaptive security appliance software (versions: >= 9.19, < 9.19.1.37)
cisco / adaptive security appliance software (versions: >= 9.20, < 9.20.3.7)
cisco / adaptive security appliance software (versions: >= 9.22, < 9.22.1.3)
cisco / firepower threat defense (versions: >= 7.0.0, < 7.0.8.1)
cisco / firepower threat defense (versions: >= 7.1.0, < 7.2.9)
cisco / firepower threat defense (versions: >= 7.3.0, < 7.4.2.4)
cisco / firepower threat defense (versions: 7.6.0)
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (versions: 9.8.1, 9.8.1.5, 9.8.1.7, 9.8.2, 9.8.2.8, 9.8.2.14, 9.8.2.15, 9.8.2.17, 9.8.2.20, 9.8.2.24)
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software (versions: 6.2.3, 6.2.3.1, 6.2.3.2, 6.2.3.3, 6.2.3.4, 6.2.3.5, 6.2.3.6, 6.2.3.7, 6.2.3.8, 6.2.3.10)

Weakness Classification

CWE-120

Repositories for Lab Validation (Public Examples)

No public repository matched this CVE query in the current run.

People and Organizations Mentioned

cisco

Practical Defensive Validation (Authorized Only)

Use only isolated environments and systems you own or are explicitly authorized to test.
Snapshot infrastructure before validation and preserve baseline logs (EDR, SIEM, OS, app).
Inventory cisco / adaptive security appliance software (versions: >= 9.12, < 9.12.4.72) assets and confirm exact vulnerable versions with automated checks.
Patch in staged environments and validate closure with scanners + service health checks.
Map detections to MITRE ATT&CK tactics relevant to your environment and tune alert quality.

References

This content is for defensive security training and authorized validation only.