{"id":"CVE-2025-20363","published":"2025-09-25T16:12:55Z","modified":"2026-02-26T17:47:56Z","title":"A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure…","vendor":"Cisco","product":"IOS","tier":"core","eol":null,"affectedVersions":[{"vendor":"Cisco","product":"IOS","versions":["12.2(15)B","12.2(16)B1","12.2(16)B2","12.2(16)B","12.2(15)BC2a","12.2(15)BC1a","12.2(15)BC1b","12.2(15)BC2d","12.2(15)BC2g","12.2(15)BC1g"]},{"vendor":"Cisco","product":"Cisco IOS XR Software","versions":["6.5.1","6.5.2","6.5.3","6.6.2","6.6.3","6.6.25","6.7.1","6.7.2","6.7.3","6.8.1"]},{"vendor":"Cisco","product":"Cisco Adaptive Security Appliance (ASA) Software","versions":["9.8.1","9.8.1.5","9.8.1.7","9.8.2","9.8.2.8","9.8.2.14","9.8.2.15","9.8.2.17","9.8.2.20","9.8.2.24"]},{"vendor":"Cisco","product":"Cisco IOS XE Software","versions":["3.2.0SG","3.2.1SG","3.2.2SG","3.2.3SG","3.2.4SG","3.2.5SG","3.2.6SG","3.2.7SG","3.2.8SG","3.2.9SG"]},{"vendor":"Cisco","product":"Cisco Firepower Threat Defense Software","versions":["6.2.3","6.2.3.1","6.2.3.2","6.2.3.3","6.2.3.4","6.2.3.5","6.2.3.6","6.2.3.7","6.2.3.8","6.2.3.10"]}],"description":{"text":"A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. \r\n\r This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device.\r\n\r For more information about this vulnerability, see the Details [\"#details\"] section of this advisory.","provenance":"source","from":"CVE.org"},"summary":{"text":"A critical heap-based buffer overflow in the web services of Cisco Secure Firewall ASA Software, Cisco Secure Firewall FTD Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could let an unauthenticated remote attacker (on ASA and FTD) or an authenticated remote attacker with low privileges (on IOS, IOS XE, and IOS XR) execute arbitrary code as root. This may lead to complete compromise of the affected device.","provenance":"ai","model":"deepseek-v4-flash","generatedAt":"2026-10-23T03:20:06Z"},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.06917,"percentile":0.94079,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-10-06","exploitedFirstSeen":"2025-10-06","ransomware":false,"evidence":[{"url":"https://blog.hunterstrategy.net/cisco-0-day-exploitation-arcanedoor-attribution-confirmed/","date":"2025-10-06"},{"url":"https://www.rapid7.com/cdn/assets/bltbd2f1cd70f9e3e7f/691360b9c91291146f1a5308/threat-landscape-report-q3-2025.pdf","date":"2025-11-12"},{"url":"https://beazley.security/insights/quarterly-threat-report-third-quarter-2025","date":"2025-11-20"},{"url":"https://fortiguard.fortinet.com/outbreak-alert/cisco-asa-and-ftd-firewall-zero-day","date":"2025-12-18"},{"url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report","date":"2026-02-25"},{"url":"https://images.global.fortinet.com/Web/FortinetInc2/%7B4e3646cf-fdb5-4c17-8bca-4f506f5731e0%7D_Outbreak_Alerts_-_Annual_Report_2025_FINAL.pdf","date":"2026-03-09"},{"url":"https://www.fortinet.com/resources/reports/threat-landscape-report","date":"2026-05-01"},{"url":"https://www.fortinet.com/library/soc-dgt/global-threat-landscape-report","date":"2026-05-06"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"Ernstige kwetsbaarheden in Cisco Secure Firewall ASA en FTD [Nationaal Cyber Security Centrum - Nieuwsberichten]","url":"https://otx.alienvault.com/pulse/6a6cfeace6f82d404b3cd587","created":"2026-07-31"},{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"}],"provenance":"machine"},"cwes":[{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O","tags":[]}],"techniques":[],"reports":[{"id":"SRC-78e2285773915bb291c1","title":"ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","date":"2024-04-24","mentions":[{"quote":"*Update 2025-09-25: Cisco is aware of new activity targeting certain Cisco Adaptive Security Appliances (ASA) 5500-X Series and has released three CVE’s related to the event: CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363.","start":89,"end":314}]},{"id":"SRC-4a68d24205d7fc9a3e3d","title":"Cisco Event Response: Continued Attacks Against Cisco Firewalls","publisher":"sec.cloudapps.cisco.com","url":"https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks","date":null,"mentions":[{"quote":"CVE-2025-20363","start":13284,"end":13298},{"quote":"First Fixed Release forCVE-2025-20363 Critical","start":13970,"end":14016},{"quote":"First Fixed Release forCVE-2025-20363 Critical","start":14934,"end":14980}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-31138","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31138","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-04-24","kind":"report","label":"Named in blog.talosintelligence.com: ArcaneDoor - New espionage-focused campaign found targeting perimeter network devi…","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","provenance":"machine"},{"date":"2025-09-25","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-20363","provenance":"source"},{"date":"2025-10-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.hunterstrategy.net/cisco-0-day-exploitation-arcanedoor-attribution-confirmed/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":67.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 389 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.82,"detail":"percentile 0.9408"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.3,"detail":"base score 9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}