A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.

Zero-day vulnerability in Cisco ASA and FTD that was exploited in the wild by the same threat actor behind the ArcaneDoor campaign. Patch as soon as possible.

IOS XR cisco-sa-http-code-exec-WmfP3h3O

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a vulnerability:

  - A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco     Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary     code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S)     requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP     requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root,     possibly resulting in the complete compromise of the affected device. (CVE-2025-20333)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

According to its self-reported version, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software is affected by a vulnerability:

  - A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco     Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary     code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S)     requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP     requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root,     possibly resulting in the complete compromise of the affected device. (CVE-2025-20333)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

ID	Name	Product	Family	Severity
265943	Cisco Secure Firewall Threat Defense Software VPN Web Server Remote Code Execution (cisco-sa-asaftd-webvpn-z5xP8EUB)	Nessus	CISCO	critical
265942	Cisco Secure Firewall Adaptive Security Appliance VPN Web Server Remote Code Execution (cisco-sa-asaftd-webvpn-z5xP8EUB)	Nessus	CISCO	critical

Detections

Analytics

CVE-2025-20333

critical

Tenable Plugins

Coming Soon

critical

critical