Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
A buffer overflow in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software, caused by improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials who can reach the device over the network can send crafted HTTP requests to execute arbitrary code as root, which could lead to complete compromise of the device, with no user interaction required.
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.
First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) appeared 8 months after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
VPN web server remote access with valid credentials
could allow an authenticated, remote attacker to execute arbitrary code
arbitrary code execution as root
could allow the attacker to execute arbitrary code as root
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2025-20333 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
*Update 2025-09-25: Cisco is aware of new activity targeting certain Cisco Adaptive Security Appliances (ASA) 5500-X Series and has released three CVE’s related to the event: CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363.
2 passages name itOriginal (opens in a new tab) ↗
UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.
UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.
UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.
The evidence collected strongly indicates that CVE-2025-20333 and CVE-2025-20362 were used by the attacker in the current attack campaign.
4 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.