{"id":"CVE-2025-20333","published":"2025-09-25T16:15:32Z","modified":"2026-10-18T21:10:00Z","title":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow…","vendor":"Cisco","product":"Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense","tier":"core","eol":null,"description":{"text":"A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device.\r\n\r This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.","provenance":"source","from":"NVD"},"summary":{"text":"A buffer overflow in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software, caused by improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials who can reach the device over the network can send crafted HTTP requests to execute arbitrary code as root, which could lead to complete compromise of the device, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:38Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.71207,"percentile":0.99407,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-09-25","dueDate":"2025-09-26","ransomware":false,"requiredAction":"The KEV due date refers to the deadline by which FCEB agencies are expected to review and begin implementing the guidance outlined in Emergency Directive (ED) 25-03 (URL listed below in Notes). Agencies must follow the mitigation steps provided by CISA (URL listed below in Notes) and vendor’s instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","notes":"CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-25-03-core-dump-and-hunt-instructions ; https://www.cisa.gov/eviction-strategies-tool/create-from-template ; https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks ;    https://sec.cloudapps.cisco.com/security/center/private/resources/asa_ftd_continued_attacks#Details ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB ; https://nvd.nist.gov/vuln/detail/CVE-2025-20333","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-09-25","exploitedFirstSeen":"2025-09-25","ransomware":false,"evidence":[{"url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","date":"2025-09-25"},{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB","date":"2025-09-25"},{"url":"https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks","date":"2025-09-25"},{"url":"https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices","date":"2025-09-25"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-09-25"},{"url":"https://moje.cert.pl/komunikaty/2025/36/aktywnie-wykorzystywane-krytyczne-podatnosci-w-urzadzeniach-cisco-asa-i-cisco-firepower/","date":"2025-09-26"},{"url":"https://research.checkpoint.com/2025/29th-september-threat-intelligence-report/","date":"2025-09-29"},{"url":"https://blog.hunterstrategy.net/cisco-0-day-exploitation-arcanedoor-attribution-confirmed/","date":"2025-10-06"},{"url":"https://www.recordedfuture.com/blog/september-2025-cve-landscape","date":"2025-10-17"},{"url":"https://insights.nccgroup.com/reveiew-of-q3-2025-threat-intelligence-report","date":"2025-10-29"}],"evidenceTotal":26,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB","tags":["Vendor Advisory"]},{"url":"https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20333","tags":["US Government Resource"]}],"techniques":[{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: VPN web server remote access with valid credentials","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could allow an authenticated, remote attacker to execute arbitrary code","start":162,"end":233}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution as root","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could allow the attacker to execute arbitrary code as root","start":507,"end":565}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-78e2285773915bb291c1","title":"ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","date":"2024-04-24","mentions":[{"quote":"*Update 2025-09-25: Cisco is aware of new activity targeting certain Cisco Adaptive Security Appliances (ASA) 5500-X Series and has released three CVE’s related to the event: CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363.","start":89,"end":314},{"quote":"UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.","start":23159,"end":23286}]},{"id":"SRC-29d0b86e8592bf01f10c","title":"Breaking the silence","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/","date":"2022-12-08","mentions":[{"quote":"UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.","start":24304,"end":24431}]},{"id":"SRC-85c03a59069479556202","title":"TeamTNT Targeting AWS, Alibaba","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/","date":"2022-04-21","mentions":[{"quote":"UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.","start":31022,"end":31149}]},{"id":"SRC-65ab06ae92274f14e50e","title":"DNS Hijacking Abuses Trust In Core Internet Service","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/seaturtle/","date":"2019-04-17","mentions":[{"quote":"UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.","start":22006,"end":22133}]},{"id":"SRC-4a68d24205d7fc9a3e3d","title":"Cisco Event Response: Continued Attacks Against Cisco Firewalls","publisher":"sec.cloudapps.cisco.com","url":"https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks","date":null,"mentions":[{"quote":"Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362.","start":1537,"end":1752},{"quote":"The evidence collected strongly indicates that CVE-2025-20333 and CVE-2025-20362 were used by the attacker in the current attack campaign.","start":12242,"end":12380},{"quote":"CVE-2025-20333","start":13060,"end":13074},{"quote":"However, Cisco has also patched CSCwq79815 in addition for defensive posture, the fixed releases in this table should be considered as the confirmed first fixed release for CVE-2025-20333 for each code train.","start":15649,"end":15857},{"quote":"The Snort rule for CVE-2025-20333 is 65340 and the Snort rule for CVE-2025-20362 is 46897.","start":16326,"end":16416}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-31140","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31140","exploited":true,"exploitedSince":"2025-09-25","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2026-05-16","earliestUrl":"https://github.com/curtishoughton/Cisco-ASA-CVE-2025-20333-Scanner","repos":[{"name":"curtishoughton/Cisco-ASA-CVE-2025-20333-Scanner","url":"https://github.com/curtishoughton/Cisco-ASA-CVE-2025-20333-Scanner","stars":0,"created":"2026-05-16"},{"name":"cobbbex/Cisco-ASA-vulnerability-research","url":"https://github.com/cobbbex/Cisco-ASA-vulnerability-research","stars":0,"created":"2026-08-22"}]},"first":{"date":"2026-05-16","source":"PoC-in-GitHub","url":"https://github.com/curtishoughton/Cisco-ASA-CVE-2025-20333-Scanner"},"provenance":"source"},"detections":{"cveRules":[{"title":"Cisco ASA Exploitation Activity - Proxy","id":"15697955-6a29-47ca-92e9-0e05efae3260","level":"high","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-20333/proxy_exploit_cve_2025_20333.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-20333/proxy_exploit_cve_2025_20333.yml","techniques":["T1190"]}]},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1133"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2019-04-17","kind":"report","label":"Named in blog.talosintelligence.com: DNS Hijacking Abuses Trust In Core Internet Service","url":"https://blog.talosintelligence.com/seaturtle/","provenance":"machine"},{"date":"2022-04-21","kind":"report","label":"Named in blog.talosintelligence.com: TeamTNT Targeting AWS, Alibaba","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/","provenance":"machine"},{"date":"2022-12-08","kind":"report","label":"Named in blog.talosintelligence.com: Breaking the silence","url":"https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/","provenance":"machine"},{"date":"2024-04-24","kind":"report","label":"Named in blog.talosintelligence.com: ArcaneDoor - New espionage-focused campaign found targeting perimeter network devi…","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","provenance":"machine"},{"date":"2025-09-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-20333","provenance":"source"},{"date":"2025-09-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","provenance":"source"},{"date":"2025-09-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-09-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31140","provenance":"source"},{"date":"2026-05-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/curtishoughton/Cisco-ASA-CVE-2025-20333-Scanner","provenance":"source"}],"speed":{"daysToPublicExploit":233,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 400 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9941"},{"name":"Named in threat reports","points":10.0,"detail":"5 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-cisco-asa-cwe-120"}}