A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device. For more information about this vulnerability, see the Details ["#details"] section of this advisory.

According to its self-reported version, Cisco IOS Software is affected by a web services remote code exeuction vulnerability:

  - A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco     Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software     could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker     (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device.
    This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit     this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining     additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow     the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device.
    (CVE-2025-20363)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

According to its self-reported version, Cisco IOS-XE Software is affected by a web services remote code exeuction vulnerability:

  - A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco     Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software     could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker     (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device.
    This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit     this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining     additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow     the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device.
    (CVE-2025-20363)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

According to its self-reported version, Cisco Adaptive Security Appliance (ASA) Software is affected by a vulnerability.

  - A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software,     Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco     IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or     authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to     execute arbitrary code on an affected device.  This vulnerability is due to improper validation of user-     supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP     requests to a targeted web service on an affected device after obtaining additional information about the     system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute     arbitrary code as root, which may lead to the complete compromise of the affected device. (CVE-2025-20363)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a vulnerability.

  - A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software,     Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco     IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or     authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to     execute arbitrary code on an affected device.  This vulnerability is due to improper validation of user-     supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP     requests to a targeted web service on an affected device after obtaining additional information about the     system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute     arbitrary code as root, which may lead to the complete compromise of the affected device. (CVE-2025-20363)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

ID	Name	Product	Family	Type	Severity
265975	Cisco IOS Software Web Services Remote Code Execution (cisco-sa-http-code-exec-WmfP3h3O)	Nessus	CISCO	Combined	critical
265974	Cisco IOS XE Software Web Services Remote Code Execution (cisco-sa-http-code-exec-WmfP3h3O)	Nessus	CISCO	Combined	critical
265973	Cisco Secure Firewall Adaptive Security Appliance Software Web Services RCE (cisco-sa-http-code-exec-WmfP3h3O)	Nessus	CISCO	Local	critical
265972	Cisco Secure Firewall Threat Defense Software Web Services RCE (cisco-sa-http-code-exec-WmfP3h3O)	Nessus	CISCO	Local	critical

Detections

Analytics

CVE-2025-20363

critical

Tenable Plugins

critical

critical

critical

critical