CVE-2025-20333: Cisco ASA and FTD VPN web server buffer overflow allows root RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows authenticated remote root code execution on edge firewalls, carries a CVSS score of 9.9, is listed in CISA KEV with a one-day remediation deadline and has a very high EPSS probability.

What it is

Cisco Secure Firewall ASA and FTD Software fail to properly validate user-supplied input in HTTP(S) requests to the VPN web server, causing a classic buffer overflow (CWE-120). An attacker holding valid VPN user credentials can send crafted HTTP requests to execute arbitrary code as root, potentially fully compromising the device. Because these devices sit at the network edge and the flaw yields root code execution, it is a high-value target for defenders.

Impact

An authenticated remote attacker gains arbitrary code execution with root privileges on the firewall, allowing complete compromise of the device, including its configuration, VPN traffic handling and any trust relationships it holds.

Attack surface

Reachable over the network through the VPN web server via crafted HTTP(S) requests; the attacker must have valid VPN user credentials, and no user interaction is required. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) confirms network reachability, low attack complexity, low privileges and scope change.

Exploitation

CVE-2025-20333 was added to CISA KEV on 2025-09-25 with a due date of 2025-09-26, and EPSS gives a 30-day exploitation probability of 0.70651 (99.359th percentile), indicating active exploitation is expected or observed. No ransomware campaign use is documented in the record.

What to do

• Apply the Cisco vendor advisory (cisco-sa-asaftd-webvpn-z5xP8EUB) patches for ASA and FTD immediately; this is the primary fix.
• Follow CISA Emergency Directive 25-03 and the Cisco 'continued attacks' guidance, including any interim mitigations Cisco specifies for the VPN web server.
• Restrict or disable remote VPN web server access where operationally possible, and limit exposure of management/VPN interfaces to trusted networks.
• Audit and rotate VPN user credentials, enforce least privilege for VPN accounts, and monitor for credential abuse given the authenticated attack path.
• If mitigations cannot be applied, follow BOD 22-01 guidance for cloud services or discontinue use of the affected product as directed.

Detection

• Inspect ASA/FTD VPN web server logs and HTTP(S) request logs for malformed or unusually long requests targeting the web VPN endpoints.
• Monitor for unexpected process crashes, restarts or reloads of ASA/FTD devices, which can accompany buffer overflow exploitation attempts.
• Hunt for anomalous post-exploitation activity on the firewall, such as unexpected outbound connections, new local accounts or configuration changes.
• Correlate VPN authentication events with subsequent suspicious HTTP requests from the same source to identify credentialed exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.