Cisco · IOS
A critical heap-based buffer overflow in the web services of Cisco Secure Firewall ASA Software, Cisco Secure Firewall FTD Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could let an unauthenticated remote attacker (on ASA and FTD) or an authenticated remote attacker with low privileges (on IOS, IOS XE, and IOS XR) execute arbitrary code as root. This may lead to complete compromise of the affected device.
A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.
First seen exploited 11 days after disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Reports are matched by finding the exact id CVE-2025-20363 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
*Update 2025-09-25: Cisco is aware of new activity targeting certain Cisco Adaptive Security Appliances (ASA) 5500-X Series and has released three CVE’s related to the event: CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363.
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.