Cisco Event Response: Continued Attacks Against Cisco Firewalls
sec.cloudapps.cisco.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
3 CVEs- CVE-2025-20333Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow…Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseKEVPublic exploitCritical · 9.9T1133External Remote ServicesT1059Command and Scripting Interpreter5 reports71.2%Top 0.59%79.8priority
- CVE-2025-20362Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization…Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1499.004Application or System Exploitation5 reports87.1%Top 0.25%79.0priority
- CVE-2025-20363A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure…Cisco · IOSCritical · 9.02 reports6.9%Top 5.9%67.3priority
Where it names them
CVE-2025-20333 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362.
The evidence collected strongly indicates that CVE-2025-20333 and CVE-2025-20362 were used by the attacker in the current attack campaign.
CVE-2025-20333
However, Cisco has also patched CSCwq79815 in addition for defensive posture, the fixed releases in this table should be considered as the confirmed first fixed release for CVE-2025-20333 for each code train.
The Snort rule for CVE-2025-20333 is 65340 and the Snort rule for CVE-2025-20362 is 46897.
CVE-2025-20362 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362.
The evidence collected strongly indicates that CVE-2025-20333 and CVE-2025-20362 were used by the attacker in the current attack campaign.
CVE-2025-20362
First Fixed Release forCVE-2025-20362 Medium
First Fixed Release forCVE-2025-20362 Medium
CVE-2025-20363 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2025-20363
First Fixed Release forCVE-2025-20363 Critical
First Fixed Release forCVE-2025-20363 Critical
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.